Journal of Artificial Intelligence Research 10 (1999) 117-167 



Submitted 2/98; published 3/99 



Modeling Belief in Dynamic Systems 
Part II: Revision and Update 

Nir Friedman nir@cs.huji.ac.il 

Institute of Computer Science 

Hebrew University, Jerusalem, 91904, ISRAEL 

http : //www. cs . huj i . ac . il/~nir 

rn " 

Joseph Y. Halpern halpern@cs.cornell.edu 

| Computer Science Department 

Cornell University, Ithaca, NY 14853 
http : //www. cs . Cornell . edu/home/halpern 



o 



< 



- 1—1 

X 



C3 



Abstract 



The study of belief change has been an active area in philosophy and AI. In recent years 
two special cases of belief change, belief revision and belief update, have been studied in 
detail. In a companion paper (Friedman & Halpern, 1997), we introduce a new framework 
to model belief change. This framework combines temporal and epistemic modalities with a 
notion of plausibility, allowing us to examine the change of beliefs over time. In this paper, 
we show how belief revision and belief update can be captured in our framework. This 
allows us to compare the assumptions made by each method, and to better understand the 
principles underlying them. In particular, it shows that Katsuno and Mendelzon's notion 
of belief update (Katsuno & Mendelzon, 1991a) depends on several strong assumptions 
' that may limit its applicability in artificial intelligence. Finally, our analysis allow us to 

identify a notion of minimal change that underlies a broad range of belief change operations 
■ including revision and update. 

*p. ' 1. Introduction 



The study of belief change has been an active area in philosophy and artificial intelligence. 



The focus of this research is to understand how an agent should change her beliefs as a result 



of getting new information. Two instances of this general phenomenon have been studied 
in detail. Belief revision (Alchourron, Gardenfors, & Makinson, 1985; Gardenfors, 1988) 
focuses on how an agent should change her (set of) beliefs when she adopts a particular 
new belief. Belief update (Katsuno & Mendelzon, 1991a), on the other hand, focuses on 
how an agent should change her beliefs when she realizes that the world has changed. Both 
approaches attempt to capture the intuition that an agent should make minimal changes 
in her beliefs in order to accommodate the new belief. The difference is that belief revision 
attempts to decide what beliefs should be discarded to accommodate a new belief, while 
belief update attempts to decide what changes in the world led to the new observation. 1 



1. Throughout the paper we use "revision" to refer to AGM's proposal for revision (Alchourron et al., 1985) 
not as a generic term for the general approach initiated by AGM; similarly, we use "update" to refer to 
KM's proposal for update (Katsuno & Mendelzon, 1991a). 
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Belief revision and belief update are two of many possible ways of modeling belief change. 
In (Friedman & Halpern, 1997), we introduce a general framework for modeling belief 
change. We start with the framework for analyzing knowledge in multi-agent systems, 
introduced in (Halpern & Fagin, 1989), and add to it a measure of plausibility at each 
situation. We then define belief as truth in the most plausible situations. The resulting 
framework is very expressive; it captures both time and knowledge as well as beliefs. Having 
time allows us to reason in the framework about changes in the beliefs of the agent. It also 
allows us to relate the beliefs of the agent about the future with her actual beliefs in the 
future. Knowledge captures in a precise sense the non-defeasible information the agent has 
about the world, while belief captures the defeasible assumptions implied by her plausibility 
assessment. The framework allows us to represent a broad spectrum of notions of belief 
change. In this paper, we focus on how, in particular, belief revision and update can be 
represented. 

We are certainly not the first to provide semantic models for belief revision and update. 
For example, (Alchourron et al., 1985; Grove, 1988; Gardenfors & Makinson, 1988; Rott, 
1991; Boutilier, 1992; de Rijke, 1992) deal with revision, and (Katsuno & Mendelzon, 1991a; 
del Val & Shoham, 1992) deal with update. In fact, there are several works in the literature 
that capture both using the same machinery (Katsuno & Satoh, 1991; Goldszmidt & Pearl, 
1996; Boutilier, 1998), and others that simulate belief revision using belief update (Grahne, 
Mendelzon, & Rieter, 1992; del Val & Shoham, 1994). Our approach is different from most 
in that we do not construct a specific framework to capture one or both of these belief 
change paradigms. Instead, we start from a natural framework to model how an agent's 
knowledge changes over time and add to it machinery that captures a defeasible notion of 
belief. 

We believe that our representation offers a number of advantages, and gives a deeper 
understanding of both revision and update. For one thing, we show that both revision and 
update can be viewed as proceeding by conditioning on initial prior plausibilities. Thus, 
our representation emphasizes the role of conditioning as a way of understanding minimal 
change. Moreover, it shows that that the major differences between revision and update 
can be understood as corresponding to differences in initial beliefs. For example, revision 
places full belief on the assumption that the propositions used to describe the world are 
static, and do not change their truth value over time. By way of contrast, update allows for 
the possibility that propositions change their truth value over time. However, the family of 
prior plausibilities that we use to capture update in our framework have the property that 
they prefer sequences of events where abnormal events occur as late as possible. Because of 
this property, conditioning in update always "explains" observations by recent changes. The 
fact that time appears explicitly in our framework allows us to make these issues precise. 

In the literature, revision has been viewed as dealing with static worlds (although an 
agent's beliefs may change, the underlying world about which the agent is reasoning does 
not) while update has been viewed as dealing with dynamic worlds (see, for example, (Kat- 
suno & Mendelzon, 1991a)). We believe that the distinction between static and dynamic 
worlds is somewhat misleading. In fact, what is important for revision is not that the world 
is static, but that the propositions used to describe the world are static. For example, "At 
time the block is on the table" is a static proposition, while "The block is on the table" is 
not, since it implicitly references the current state of affairs. (Note that the assumption that 
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the propositions are static is not unique to belief revision. Bayesian updating, for example, 
makes similar assumptions.) Because we model time explicitly in our framework, we can 
examine this issue in more detail. In fact, in Section 7, we show how we relate these two 
viewpoints. More precisely, given a system, we replace each proposition p used in the system 
by a family of propositions "p is true at time m" , one for each time m. The resulting system 
describes exactly the same process as the original system, but from a different linguistic per- 
spective. As we show, if the original system corresponds to KM update, then the resulting 
system is very close to satisfying the requirements of AGM revision. The only requirement 
that is not met is that the prior is totally ordered, or ranked. This requirement, however, 
has been relaxed in several variants of revision (Katsuno & Mendelzon, 1991b; Rott, 1992). 
Thus, a large part of the difference between revision and update can be understood as a 
difference in the language used to describe what is happening. 

The generality of our framework forces us to be clear about the assumptions we make 
in the process of capturing revision and update. As a consequence, we have to deal with 
issues that have been largely ignored by previous semantic accounts. One of these issues 
is the status of observations. As we show below, to capture either revision or update, we 
have to assume that observations are minimally informative — the only information carried 
by an observation of ip is that <p should be believed. This is a strong assumption, since 
most observations carry additional information. For example, when trekking in Nepal, 
one does not expect to observe the weather in Boston. If an agent observes that it is in 
fact raining in Boston, then this "observation" might well provide extra information about 
the world (for example, that cable television is available in Nepal). We remark that in 
(Boutilier, Friedman, & Halpern, 1998) there is a treatment of revision in our framework 
where observations are allowed to convey additional information. 

Finally, our representation makes it clear how the intuitions of revision and update 
can be applied in settings where the postulates used to describe them are not sound. For 
example, we consider situations where they may be irreversible changes (such as death, 
or breaking a glass vase), and where the agent may perform actions beyond just making 
observations. Revision and update, as they stand, cannot handle such situations. As we 
show, our framework allows us to extend them in a natural way so they do. 

The rest of the paper is organized as follows. In Section 2, we give an overview of the 
framework we introduced in (Friedman & Halpern, 1997). In Section 3, we give a brief review 
of belief revision and belief update. In Section 4, we define a specific class of structures 
that embody assumptions that are common to both update and revision. In Section 5, 
we describe additional assumptions that are required to capture revision. In Section 6, we 
describe the assumptions that are required to capture update. In Section 7, we reexamine 
the differences and similarities between belief revision and update. In Section 8, we consider 
possible extensions to the setup of revision and update, and discuss how these extensions 
can be handled in our framework. Finally, in Section 9, we conclude with a discussion of 
related and future work. 
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2. The Framework 

We now review the framework of Halpern and Fagin (1989) for modeling knowledge, and our 
extension of it for dealing with belief change. The reader is encouraged to consult (Fagin, 
Halpern, Moses, & Vardi, 1995) for further details and motivation. 

2.1 Modeling Knowledge 

The framework of Halpern and Fagin was developed to model knowledge in distributed 
(i.e., multi-agent) systems (Halpern & Fagin, 1989; Fagin et al., 1995). In this paper, we 
restrict our attention to the single agent case. The key assumption in this framework is that 
we can characterize the system by describing it in terms of a state that changes over time. 
Formally, we assume that at each point in time, the agent is in one of a possibly infinite 
set of (local) states. At this point, we do not put any further structure on these states 
(although, as we shall see from our examples, when we model situations in a natural way, 
states typically do have a great deal of meaningful structure). Intuitively, this local state 
encodes the information the agent has observed thus far. There is also an environment, 
whose state encodes relevant aspects of the system that are not part of the agent's local 
state. 

A global state is a pair (s e , s a ) consisting of the environment state s e and the local state 
s a of the agent. A run of the system is a function from time (which, for ease of exposition, 
we assume ranges over the natural numbers) to global states. Thus, if r is a run, then 
r(0), r(l), ... is a sequence of global states that, roughly speaking, is a complete description 
of what happens over time in one possible execution of the system. Given a run r, we can 
define two functions r e and r a that map from time to states of the environment and the 
agent, respectively, by taking r e (m) to be the state of the environment in the global state 
r(m) and r a (m) to be the agent's local state in r(m). We can thus identify run r with the 
pair of functions (r e ,r a ). We take a system to consist of a set of runs. Intuitively, these 
runs describe all the possible behaviors of the system, that is, all the possible sequences of 
events that could occur in the system over time. 

Given a system TZ, we refer to a pair (r, m) consisting of a run r £ K and a time m 
as a point. We say two points (r, m) and (r', m!) are indistinguishable to the agent, and 
write (r, m) ~ a (r', m'), if r a {m) = r' a (m'), i.e., if the agent has the same local state at both 
points. Finally, an interpreted system 1 is a tuple (7Z, tt) consisting of a system TZ together 
with a mapping tt that associates with each point a truth assignment to a set <I> of primitive 
propositions. In an interpreted system we can talk about an agent's knowledge: the agent 
knows (p at a point (r, m) if (p holds in all points (r',m') such that (r,m) ~ a (r',m'). 
Intuitively, an agent knows <p at (r, m) if <p is implied by the information in the local state 
r a (m). We give formal semantics for a language of knowledge (and time and plausibility) 
in Section 2.3. 

Example 2.1: The circuit diagnosis problem has been well studied in the literature (see 
(Davis & Hamscher, 1988) for an overview). Consider a circuit that contains n logical 
components c\ , . . . , c n and k lines l\ , . . . , . The agent can set the values on the input lines 
of the circuit and observe the values on the output lines. The agent then compares the actual 
output values to the expected output values and attempts to locate faulty components. 
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Since a single test is usually insufficient to locate the problem, the agent might perform a 
sequence of such tests. 

We want to model diagnosis using an interpreted system. To do so, we need to describe 
the agent's local state, the state of the environment, and some appropriate propositions 
for reasoning about diagnosis. Intuitively, the agent's state is the sequence of input-output 
relations observed, while the environment's state describes the current state of the circuit. 
This consists of the failure set, that is, the set of faulty components of the circuit and the 
values on all the lines in the circuit. Each run describes the results of a specific series of 
tests the agent performs and the results she observes. We make two additional assumptions: 
(1) the agent does not forget what tests were performed and their results, and (2) the faults 
are persistent and do not change over time. 

To make this precise, we define the environment state at a point (r,m) to consist of 
the failure set at (r, m), which we denote fault(r,m), as well as the values of all the lines 
in the circuit. We require that the environment state be consistent with the description 
of the circuit. Thus, for example, if ci is an AND gate with input lines l\ and I2 and 
output line I3, then if r e (m) says that c\ is not faulty, then we require that there is a 
1 on Z3 if and only if there is a 1 on both \\ and I2? We capture the assumption that 
faults are persistent by requiring that fault(r,m) = fault(r,0). For our later results, it is 
useful to describe the agent's observations using our logical language. Consider the set 
®diag = ■ ■ ■ , fn, hi , . . . , hk} of primitive propositions, where fa denotes that component 
i is faulty and hi denotes that there is a 1 on line i (that is, line i in a "high" state). An 
observation is a conjunction of literals of the form hi and -i/ij. The agent's state at time 
m is a sequence of m such observations. Formally, we define the agent's state r a (m) to 
be (oi,...,o m ), where, intuitively, Ok is the formula describing the input-output relation 
observed at time k. We use the notation io(r, k) to denote the formula describing the 
observation made by the agent at the point (r,k). Given this language, we can define the 
interpretation Ttdiag in the obvious way. We say that an observation o is consistent with an 
environment state r e (m) if the states of the input /output lines in r e (m) agree with these in 
o. The system IZdiag consists of all runs r satisfying these requirements in which io(r, m) is 
consistent with r e {m) for all times m. 

Given the system (TZdiag,^diag), we can examine the agent's knowledge after making a 
sequence of observations 01, . . . ,o m . It is easy to see that the agent knows that the fault set 
must be one with which all the observations are consistent. However, the agent cannot rule 
out any of these fault sets. Thus, even if all the observations are consistent with the circuit 
being fault-free, the agent does not know that the circuit is fault-free, since there might be 
a fault that manifests itself only in configurations that have not yet been tested. Of course, 
the agent might strongly believe that the circuit is fault-free, but we cannot (yet) express 
this fact in our formalism. The next section rectifies this problem. □ 



2. Note that this means that we can recover the behavior of the circuit (although not necessarily its exact 
description) by simply looking at the environment state at a point where there are no failures. Of course, 
if we could have a yet richer environment state that encodes the actual description of the circuit, but 
this is unnecessary for the analysis we do here. 
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2.2 Plausibility Measures 

Most non-probabilistic approaches to belief change require (explicitly or implicitly) that 
the agent has some ordering over possible alternatives. For example, the agent might 
have a preference ordering over possible worlds (Boutilier, 1994b; Grove, 1988; Katsuno k, 
Mendelzon, 1991b) or an entrenchment ordering over formulas (Gardenfors & Makinson, 
1988). This ordering dictates how the agent's beliefs change. For example, in (Grove, 1988), 
the new beliefs are characterized by the most preferred worlds that are consistent with the 
new observation, while in (Gardenfors & Makinson, 1988), beliefs are discarded according 
to their degree of entrenchment until it is consistent to add the new observation to the 
resulting set of beliefs. We represent this ordering using plausibility measures, which were 
introduced in (Friedman & Halpern, 1995, 1998b). We briefly review the relevant definitions 
and results here. 

Recall that a probability space is a tuple (W, T, Pr), where W is a set of worlds, T is 
an algebra of measurable subsets of W (that is, a set of subsets closed under union and 
complementation to which we assign probability), and Pr is a probability measure, that is, a 
function mapping each set in T to a number in [0, 1] satisfying the well-known probability 
axioms (Pr(0) = 0, Pr(W) = 1, and Pr(A U B) = Pr(A) + Pr(B), if A and B are disjoint). 

Plausibility spaces are a direct generalization of probability spaces. We simply replace 
the probability measure Pr by a plausibility measure PI, which, rather than mapping sets in 
T to numbers in [0, 1], maps them to elements in some arbitrary partially ordered set. We 
read P1(A) as "the plausibility of set A". If P1(A) < Pl(-B), then B is at least as plausible 
as A. Formally, a plausibility space is a tuple S = (W, T, PI), where W is a set of worlds, T 
is an algebra of subsets of W, and PI maps sets in T to some domain D of plausibility values 
partially ordered by a relation <d (so that <d is reflexive, transitive, and anti-symmetric). 
We assume that D is pointed: that is, it contains two special elements Tp, and J_£> such 
that J_d<d d <D Tfl for all d G D; we further assume that P1(W) = To and P1(0) =_I_d- 
As usual, we define the ordering <£> by taking d\ <d di if d\ <d di and d\ 7^ cfe- We omit 
the subscript D from <£>, <£>, To, and whenever it is clear from context. 

Since we want a set to be at least as plausible as any of its subsets, we require 

Al If A C B, then P1(A) < P1(B). 

Some brief remarks on this definition: We have deliberately suppressed the domain D 
from the tuple S, since for the purposes of this paper, only the ordering induced by < on 
the subsets in T is relevant. The algebra T also does not play a significant role in this 
paper. Unless we say otherwise, we assume T contains all subsets of interest and suppress 
mention of J-, denoting a plausibility space as a pair (W, PI). 

Clearly plausibility spaces generalize probability spaces. In (Friedman & Halpern, 1998b, 
1995) we show that they also generalize belief function (Shafer, 1976), fuzzy measures (Wang 
& Klir, 1992), possibility measures (Dubois & Prade, 1990), ordinal ranking (or K-ranking) 
(Goldszmidt & Pearl, 1996; Spohn, 1988), preference orderings (Kraus, Lehmann, & Magi- 
dor, 1990; Shoham, 1987), and parameterized probability distributions (Goldszmidt, Morris, 
& Pearl, 1993) that are used as a basis for Pearl's e-semantics for defaults (Pearl, 1989). 

Our goal is to describe the agent's beliefs in terms of plausibility. To do this, we describe 
how to evaluate statements of the form Btp given a plausibility space. In fact, we use a 
richer logical language that also allows us to describe how the agent compares different 
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alternatives. This is the logic of conditionals. Conditionals are statements of the form 
p — tip, read "given p, ip is plausible" or "given p, then by default ip" . The syntax of the 
logic of conditionals is simple: we start with primitive propositions and close off under 
conjunction, negation and the modal operator — >. The resulting language is denoted CP . 

A plausibility structure is a tuple PL = (W,Pl,ir), where W is a set of possible worlds, 
PI is a plausibility measure on W, and tt(w) is a truth assignment to primitive propositions. 
Given a plausibility structure PL = (W,P1, 7r), we define [</?]pl = {w € W : ir(w) \= p} to 
be the set of worlds that satisfy p. We omit the subscript PL, when it is clear from the 
context. Conditionals are evaluated according to a rule that is essentially the same as the 
one used by Dubois and Prade (1991) to evaluate conditionals using possibility measures: 

• PL \= p^ip if either Pl( [</>]) =± or Pl({p Aip})> Pl{{p A ->ip}). 

Intuitively, (p—*ip holds vacuously if p is impossible; otherwise, it holds if ip A ip is more 
plausible than p A ->ip. As we show in (Friedman & Halpern, 1998b), this semantics of 
conditionals also generalizes the semantics of conditionals in K-ranking (Goldszmidt & Pearl, 
1996), and PPD structures (Goldszmidt et al., 1993). As we also show in (Friedman & 
Halpern, 1998b), this semantics for conditionals generalizes the semantics of preferential 
structures. As this relationship plays a role in the discussion below, we review the necessary 
definitions here. A preferential structure is a tuple (W,~<,tt), where -< is a partial order 
on W. Roughly speaking, w ~< w' holds if w is preferred to w' . 3 The intuition (Shoham, 
1987) is that a preferential structure satisfies a conditional ip— >ip if all the most preferred 
worlds (i.e., the minimal worlds according to -<) in {pj satisfy ip. However, there may be 
no minimal worlds in [92]. This can happen if [99] contains an infinite descending sequence 
. . . -< W2 ~< wi. What do we do in these structures? There are a number of options: the first 
is to assume that, for each formula ip, there are minimal worlds in {pj; this is the assumption 
actually made in (Kraus et al., 1990), where it is called the smoothness assumption. A yet 
more general definition — one that works even if -< is not smooth — is given in (Lewis, 1973; 
Boutilier, 1994a). Roughly speaking, ip — >ip is true if, from a certain point on, whenever p 
is true, so is ip. More formally, 

(W, ~<,ir) satisfies <p — >ip, if for every world w\ € [<£>], there is a world W2 such 
that (a) u>2 -< w\ (so that W2 is at least as normal as W\), (b) u>2 G \p A ip}, and 
(c) for all worlds W3 ~< W2, we have w 3 € \p =5- ip} (so any world more normal 
than W2 that satisfies p also satisfies ip). 

It is easy to verify that this definition is equivalent to the earlier one if -< is smooth. 

Proposition 2.2 : (Friedman & Halpern, 1998b) If -< is a preference ordering on W , 
then there is a plausibility measure Pl^ on W such that (W,-<,ir) \= p — >ip if and only if 
(W,PL<,7r) \=^iP. 

We briefly describe the construction of Pl^ here, since we use it in the sequel. Given 
a preference order -< on W, let Dq be the domain of plausibility values consisting of one 

3. We follow the standard notation for preference here (Kraus et al., 1990), which uses the (perhaps con- 
fusing) convention of placing the more likely (or less abnormal) world on the left of the -< operator. 
Unfortunately, when translated to plausibility, this will mean w -< w' holds iff Pl({w} > Pl({«/}). 
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element d w for every element w £ W. We define a partial order on D$ using -<: d v < d w 
if w -< v. (Recall that w -< w' denotes that w is preferred to w' .) We then take D to be 
the smallest set containing Dq that is closed under least upper bounds (so that every set 
of elements in D has a least upper bound in D). For a subset A of W, we can then define 
Pl^(A) to be the least upper bound of {d w : w £ A}. Since D is closed under least upper 
bounds, Pl(-A) is well defined. As we show in (Friedman & Halpern, 1998b), this choice of 
Pl^ satisfies Proposition 2.2. 

The results of (Friedman & Halpern, 1998b) show that this semantics for conditionals 
generalizes previous semantics for conditionals. Does this semantics capture our intuitions 
about conditionals? In the AI literature, there has been little consensus on the "right" 
properties for defaults (which are essentially conditionals). However, there has been some 
consensus on a reasonable "core" of inference rules for default reasoning. This core is usually 
known as the KLM properties (Kraus et al., 1990), and includes such properties as 

AND From (p — and <p — >ip2 infer <p — A ^2 

OR From (pi — tip and tf2 — ►V' infer ip\ V (p2 — 

What constraints on plausibility spaces gives us the KLM properties? Consider the following 
two conditions: 

A2 If A, B, and C are pairwise disjoint sets, Pl(AuB) > P1(C), and Pl(AuC) > 
Pl(-B), then P1(A) > P1(B U C). 

A3 If P1(A) = P1(B) =_L, then P1(A U B) =_L. 

A plausibility space (W, PI) is qualitative if it satisfies A2 and A3. A plausibility struc- 
ture (W, PI, 7r) is qualitative if (W, PI) is a qualitative plausibility space. In (Friedman & 
Halpern, 1998b), we show that, in a very general sense, qualitative plausibility structures 
capture default reasoning. More precisely, we show that the KLM properties are sound 
with respect to a class of plausibility structures if and only if the class consists of qualita- 
tive plausibility structures. (We also provide a weak condition that we show is necessary 
and sufficient for the KLM properties to be complete.) These results show that plausibility 
structures provide a unifying framework for the characterization of default entailment in 
these different logics. 

2.3 Plausibility and Knowledge 

In (Friedman & Halpern, 1997) we show how plausibility measures can be incorporated into 
the multi-agent system framework of (Halpern & Fagin, 1989). This allows us to describe 
the agent's assessment of the possible states the system is in at each point in time. At the 
same time we also introduce conditionals into the logical language in order to reason about 
these plausibility assessments. We now review the relevant details. 

An (interpreted) plausibility system is a tuple (H,ir,V) where, as before, 1Z is a set 
of runs and ir maps each point to a truth assignment, and where V is a plausibility as- 
signment function mapping each point (r, m) to a qualitative plausibility space V(r, m) = 
(W{r,m)i Pl(r,m))- Intuitively, the plausibility space V(r,m) describes the relative plausibil- 
ity of events from the point of view of the agent at (r,m). In this paper, we restrict our 
attention to plausibility spaces that satisfy two additional assumptions: 
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• W(r,m) = {(r' ,m')\(r,m) ~ a (r',m')}. Thus, the agent considers plausible only situa- 
tions that are possible according to her knowledge. 

• if (r, m) ~ a (r',m') then V(r,m) = V(r',m'). This means that the plausibility space 
is a function of the agent's local state. 4 

We define a logical language to reason about interpreted systems. The syntax of the logic 
is simple; we start with primitive propositions and close off under conjunction, negation, 
the K modal operator (Kip says that the agent knows (p), the O modal operator (0<p says 
that ip is true at the next time step), and the — > modal operator. The resulting language 
is denoted C KPT . b We recursively assign truth values to formulas in C KPT at a point (r, m) 
in a plausibility system X. The truth of primitive propositions is determined by 7r, so that 

(X, r,m) \= p if 7r(r, m)(p) = true. 

Conjunction and negation are treated in the standard way, as is knowledge: The agent 
knows ip at (r, m) if tp holds at all points that she cannot distinguish from (r,m). Thus, 

(I,r,m) \= Kip if (I,r',m') \= ip for all (r',m') ~ a (r, m). 

Qnp is true at (r, m) if ip is true at (r, m + 1). Thus, 

(X, r, m) |= Oip if (J, r, m + 1) \= ip. 

Finally, we define the conditional operator — >■ to describe the agent's plausibility assessment 
at the current time. Let [v?]( r ,m) = {(r',m') G W^ r ^ : (X,r,m) \= ip}. 

(X,r,m) \= ip^-tp if either P\ r ,m)(l<f}(r,m)) = -L or Pl^d^ A V>l(r,m)) > P\r,m)(l<P A ->^]( r , 

We now define a notion of belief. Intuitively, the agent believes ip if <p is more plausible 
than not. Formally, we define Bip 44> (true-^np). 

In (Friedman & Halpern, 1997) we prove that, in this framework, knowledge is an S5 
operator, the conditional operator — > satisfies the usual axioms of conditional logic (Burgess, 
1981), and O satisfies the usual properties of temporal logic (Manna & Pnueli, 1992). In 
addition, these properties imply that belief is a K45 operator, and the interactions between 
knowledge and belief are captured by the axioms Kip =^> Bip and Bip KBip. 

Example 2.3: (Friedman & Halpern, 1997) We add a plausibility measure to the system 
defined in Example 2.1. We define l diag = (TZdiag^diag^diag), where V diag is the plausi- 
bility assignment we now describe. We assume that failures of individual components are 
independent of one another. If we also assume that the likelihood of each component failing 
is the same, and also that this likelihood is small (i.e., failures are exceptional), then we 
can construct a plausibility measure as follows. If (r',m) and (r",m) are two points in 
W^m)) we sa Y that (r',m) is more plausible than (r",m) if \fault(r', m)\ < \fault(r" ,m)\, 

4. The framework presented in (Friedman & Halpern, 1997) is more general than this, dealing with multiple 
agents and allowing the agent to consider several plausibility spaces in each local state. The simplified 
version we present here suffices to capture belief revision and update. 

5. It is easy to add other temporal modalities such as until, eventually, since, etc. These do not play a role 
in this paper. 
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that is, if the failure set at (r',m) consists of fewer faulty components than at (r",m). We 
extend these comparisons to sets: Ph rjm \(A) < Ph r rn UB) if mhi/ r i m \^(\fault{r' ^ m)\) > 
miii^ r i m ^ B {\fault(r\ m)\); that is, A is less plausible if all the points in A have failure sets 
of larger cardinality then the minimal one in B. With this plausibility measure, if all of 
the agent's observations up to time m are consistent with there being no failures, then 
the agent believes that all components are functioning correctly. On the other hand, if 
the observations do not match the expected output of the circuit, then the agent considers 
minimal failure sets that are consistent with her observations. Thus, if the observations are 
consistent with a failure of c\, or a failure of C3, or the combined failure of C2 and C7, then 
the agent believes that either c\ or C3 is faulty, but not both. 

We now make this more precise. A failure set (i.e., a diagnosis) is characterized by a 
complete formula over fi,... , /„ — that is, one that determines the truth values all these 
propositions. For example, if n = 3, then /1A-1/2A-1/3 characterizes the failure set {ci}. We 
define -D( r)m ) to be the set of failure sets (i.e., diagnoses) that the agent considers possible 
at (r, m); that is D^ r ^ = {/ € F : (Idiag, r, m) |= ->B-if} where F is the set of all possible 
failure sets. 

Belief change in Idiag is characterized by the following proposition. 

Proposition 2.4: If there is some f € -D( rjm ) that is consistent with the new observation 
io(r,m + 1), then -D( rjm+ i) consists of all the failure sets in Di r m \ that are consistent with 
io(r,m + l). If all f G Dr rm \ are inconsistent with io(r,m + l), then Dt rjn+1 \ consists of all 
failure sets of cardinality j that are consistent with io(r, 1), . . . , io(r, m + 1), where j is the 
least cardinality for which there is at least one failure set consistent with these observations. 

Thus, in Idiag, a new observation consistent with the current set of most likely explanations 
reduces this set (to those consistent with the new observation). On the other hand, a 
surprising observation (one inconsistent with the current set of most likely explanations) 
has a rather drastic effect. It easily follows from Proposition 2.4 that if io(r,m + 1) is 
surprising, then Di r m \ n -D( r ,m+i) = 0j so the agent discards all her current explanations 
in this case. Moreover, an easy induction on m shows that if D/ r jn \ n -D( r ,m+i) = 0, then 
the cardinality of the failure sets in -D( r)m +i) is greater than the cardinality of failure sets 
in D^ r m y Thus, in this case, the explanations in Dr r jn+1 \ are more complicated than those 
in D {r>rn) . □ 

2.4 Conditioning 

In an interpreted system, the agent's beliefs change from point to point as her plausibility 
space changes. The general framework does not put any constraints on how the plausibility 
space changes. If we were thinking probabilistically, we could imagine the agent starting 
with a prior on the runs in the system. Since a run describes a complete history over 
time, this means that the agent puts a prior probability on the possible sequences of events 
that could happen. We would then expect the agent to modify her prior by conditioning 
on whatever information she has learned. As we show below, this notion of conditioning is 
closely related to belief revision and update. We remark that we are not the first to applying 
conditioning in the context of belief change (cf. (Goldszmidt & Pearl, 1996; Spohn, 1988)); 
the details are a little more complex in our framework, because we model time explicitly. 
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We start by making the simplifying assumption that we are dealing with synchronous 
systems where agents have perfect recall (Halpern & Vardi, 1989). Intuitively, this means 
that the agent knows what the time is and does not forget the observations she has made. 
Formally, a system is synchronous if (r, m) ~ a (r',m') only if m = m'. In synchronous 
systems, the agent has perfect recall if (r',m + 1) ~ a (r, m + 1) implies (r',m) ~ a (r,m). 
Thus, the agent considers run r possible at the point (r, m + 1) only if she also considers 
it possible at (r,m). This means that any runs considered impossible at (r,m) are also 
considered impossible at (r,m + 1): the agent does not forget what she knew. 

Just as with probability, we assume that the agent has a prior plausibility measure on 
runs that describes her prior assessment on the possible executions of the system. As the 
agent gains knowledge, she updates her prior by conditioning. More precisely, at each point 
(r, m) , the agent conditions her previous assessment on the set of runs considered possible 
at (r, m). This results in an updated assessment (posterior) of the plausibility of runs. This 
posterior induces, via a projection from runs to points, a plausibility measure on points. 
We can think of the agent's posterior at time m as simply her prior conditioned on her 
knowledge at time m. 

Formally, the prior plausibility of the agent is a plausibility measure V a = {H, Pla) over 
the runs in the system. If A is a set of points, we define Tt{A) = {r : 3m((r, m) € A)} to be 
the set of runs on which the points in A lie. The agent updates plausibilities by conditioning 
in X if the following condition is met: 

PRIOR There is prior V a = (Tl, Pla) such that for all runs r £ TZ, times m, 
and sets A,B C W {r>m) , Pl (r , m) (A) < Pl( r , ro) (B) if and only if Pl a {K{A)) < 

This definition implies that the agent's plausibility assessment at each point is determined, 
in a straightforward fashion, by her prior. 

As shown in (Friedman & Halpern, 1997), in synchronous systems that satisfy PRIOR 
where agent have perfect recall, we can say even more: the agent's plausibility measure at 
time m + 1 is determined by her plausibility measure at time m. To make this precise, if A 
is a set of points, let prev(A) = {(r,m) : (r, m + 1) G ^4}. 

Theorem 2.5: (Friedman & Halpern, 1997). Let Z be a synchronous system satisfying 
PRIOR where agents have perfect recall. Then Pl^ rm+1 ^(A) < Pl( rim +i) (B) if and only if 
Pl( rjm ) (prev(A)) < Pl( rm -j(prev(B)) , for all runs r, times m, and sets A,BC W( rjjn+ iy 

Thus, in synchronous systems where agents have perfect recall PRIOR implies a "local" 
rule for update that incrementally changes the agent's plausibility at each step. This local 
rule consists of two steps. First, the agent's plausibility at time m is projected to time 
m + 1 points. Second, time m + 1 points that are inconsistent with the agent knowledge at 
(r, m + 1) are discarded. This procedure implies that the relative plausibility of two sets of 
runs does not change unless one of them is incompatible with the new knowledge. 

Example 2.6: It is easy to verify that the system Xdiag we consider in Example 2.3 satisfies 
PRIOR. The prior V a is determined by the failure set in each run in a manner similar to 
the construction of Pl( r;m ) . That is, R\ is more plausible than R2 if there is a run in R\ 
with a smaller failure set than all the runs in R2. □ 
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3. Review of Revision and Update 

We now present a brief review of belief revision and update. 

Belief revision attempts to describe how a rational agent incorporates new beliefs. As 
we said earlier, the main intuition is that as few changes as possible should be made. Thus, 
when something is learned that is consistent with earlier beliefs, it is just added to the set of 
beliefs. The more interesting situation is when the agent learns something inconsistent with 
her current beliefs. She must then discard some of her old beliefs in order to incorporate 
the new belief and remain consistent. The question is which ones? 

The most widely accepted notion of belief revision is defined by the AGM theory (Al- 
chourron et al., 1985; Gardenfors, 1988). This theory was originally developed in philosophy 
of science, where one attempts to understand when a scientist changes her beliefs (e.g., the- 
ory of physical laws) in a rational manner. In this context, it seems reasonable to assume 
that the world is static; that is, the laws of physics do not change while the scientist is 
performing experiments. 

Formally, this theory assumes a logical language C e over a set <E> e of primitive proposi- 
tions with a consequence relation \-£ e that contains the propositional calculus and satisfies 
the deduction theorem. The AGM approach assumes that an agent's epistemic state is 
represented by a belief set, that is, a set K of formulas in the language £ e . 6 There is also 
assumed to be a revision operator o that takes a belief set A and a formula tp and returns a 
new belief set Aop, intuitively, the result of revising A by p. The following AGM postulates 
are an attempt to characterize the intuition of "minimal change": 

(Rl) A o ip is a belief set 

(R2) p £ A o p 

(R3) A o p C Cl(A U M) 7 

(R4) U-xp^A then Cl(A U {<p}) Cio^ 

(R5) Ao p = Cl(false) if and only if h-£ e ^p 

(R6) If \~c e <p ip then Ao p = Ao ip 

(R7) Ao (p Aip) C Cl(A opU 

(R8) If -.V A o p then Cl(A opU {-0}) C A o (p A ip). 

The essence of these postulates is the following. After a revision by p the belief set 
should include p (postulates Rl and R2). If the new belief is consistent with the belief set, 
then the revision should not remove any of the old beliefs and should not add any new beliefs 
except these implied by the combination of the old beliefs with the new belief (postulates 
R3 and R4). This condition is called persistence. The next two conditions discuss the 
coherence of beliefs. Postulate R5 states that the agent is capable of incorporating any 
consistent belief and postulate R6 states that the syntactic form of the new belief does 
not affect the revision process. The last two postulates enforce a certain coherency on the 

6. For example, Gardenfors (1988, p. 21) says "A simple way of modeling the epistemic state of an individual 
is to represent it by a set of sentences." 

7. Cl(A) — {<p\A \~c e V 3 } is the deductive closure of a set of formulas A. 
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outcome of revisions by related beliefs. Basically, they state that if ip is consistent with 
A o p then A o (p A ip) is just A o p o ip. 

The notion of belief update originated in the database community (Keller & Winslett, 
1985; Winslett, 1988). The problem is how a knowledge base should change when something 
is learned about the world. For example, suppose that a transaction adds to the knowledge 
base the fact "Table 7 is in Office 2" , which contradicts the previous belief that "Table 7 
is in Office 1". What else should change? The intuition that update attempts to capture 
is that such a transaction describes a change that has occurred in the world. Thus, in our 
example, by applying update we might conclude that the reason that the table is in Office 
2 is that it was moved, not that our earlier beliefs were false. This example shows that, 
unlike revision, update does not assume that the world is static. 

Katsuno and Mendelzon (1991a) suggest a set of postulates that an update operator 
should satisfy. The update postulates are expressed in terms of formulas, not belief sets. 
That is, an update operator o maps a pair of formulas, one describing the agent's current 
beliefs and the other describing the new observation, to a new formula that describes the 
agent's updated beliefs. This is not unreasonable, since we can identify a formula p> with 
the belief set Cl(p). Indeed, if <I> is finite (which is what Katsuno and Mendelzon assume) 
every belief set A can be associated with some formula <pa such that CI(pa) = -A, and 
every formula ip corresponds to a belief set Cl{p). Thus, any update operator induces an 
operator that maps a belief set and an observation to a new belief set. We slightly abuse 
notation and use the same symbol to denote both types of mappings. We say that a belief 
set A is complete if, for every ip G C e , either <p> £ A or ^p € A. A formula jjl is complete if 
Cl(fx) is complete. 

The KM postulates are: 

(Ul) h £e nop => p 

(U2) If \~c e M => <p, then \- Ce n o <p /x 

(U3) \~c e ->/J>o<p if and only if \~c e -l /x or ^~C e ~^<P 

(U4) If \~c e f-ti M2 and \~ Ce fi f2 then \~ Ce Mi o fi <5 H2 o <f2 

(U5) h £e (fi o ip) A V => (J. o {f A V) 

(U6) If \~c e \i o <Pi => ¥2 and \~c e M o ¥2 => <Pi , then \~c e f-iopi /i o (f2 

(U7) If fx is complete then \~c e (a* fi) A (/x o p>2) =>■ fJ- o (</?i V P2) 

(U8) h £e (//i V /x 2 ) o <f<^ (pi o<f)V (/X2 o V 5 )- 

The essence of these postulates is as following. After learning p, the agent believes <p 
(postulate Ul, which is analogous to R2). If p is already believed, then updating by p does 
not change the agent's beliefs (postulate U2, which is a weaker version of R3 and R4). The 
next two postulates (U3 and U4) deal with coherence of the belief change process. They 
are analogous to R5 and R6, respectively, with minor differences. Postulates U5 and U6 
deal with observations that are related to each other. U5 states that beliefs after learning 
p that are consistent with ip are also believed after learning p A ip. U6 states that if 992 is 
believed after learning 991 and p\ is believed after learning p2, then learning either p\ or 
P2 leads to the same belief set. Finally, U7 and U8 deal with decomposition properties of 
the update operation. U7 states that if fi is essentially a truth assignment to C, then if ip 
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is believed after learning <p\ and is also believed after learning (p2 then it is believed after 
learning ip\ V 992- U8 states that the update of the knowledge base can be computed by 
independent updates on each sub-part of the knowledge. That is, if fx = fii V [12, then we 
can apply update to each of (ii and (12, and then combine the results. 

4. Belief Change Systems 

We want to model belief change — particularly belief revision and belief update — in the 
framework of systems. To do so, we consider a particular class of systems that we call 
belief change systems. In belief change systems, the agent makes observations about an 
external environment. Just as is (implicitly) assumed in both revision and update, we 
assume that these observations are described by formulas in some logical language. We 
then make other assumptions regarding the plausibility measure used by the agent. We 
formalize our assumptions as conditions BCS1-BCS5, described below, and say that a 
system I = (1Z, n, V) is a belief change system if it satisfies these conditions. We denote by 
qBCS ^ e ge £ Q £ belief change systems. 

Assumption BCS1 formalizes the intuition that our language includes propositions for 
reasoning about the environment, whose truth depends only on the environment state. 

BCS1 The language £ includes a propositional sublanguage C e over a set <3? e 
of primitive propositions. C e contains the usual propositional connectives and 
comes equipped with a consequence relation \~c e - The interpretation ir(r,m) 
assigns truth to propositions in <3? e in such a way that 

(a) ir(r,m) is consistent with \~c e , that is, {p : p £ <3? e , ir(r, m)(p) = true} U 
{->p : p G $ e , 7r(r, m)(p) = false} is \~c e consistent, and 

(b) 7r(r, m){p) depends only on r e (m) for propositions in <E> e ; that is, 7r(r, m)(p) = 
n(r' ,m')(p) whenever r e (m) = r' e (m'). 

Part (b) of BCS1 implies that we can evaluate formulas in C e with respect to environment 
states; that is, if ip € C e and r e (m) = r' e (m'), then (J, r,m) \= ip if and only if (2, r f , m!) \= (p. 
Since the environment is all that is relevant for formulas in C e , if <p G C e , we write s e \= tp 
if (I,r,m) \= (p for some point (r,m) such that r e {m) = s e . 

BCS2 is concerned with the form of the agent's local state. Recall that, in our framework, 
the local state captures the relevant aspects of the agent's epistemic state. The functional 
form of the revision and update operators suggests that all that matters regarding how an 
agent changes her beliefs are the agent's current epistemic state (which is taken by both 
AGM and KM to be a belief set) and what is learned. In terms of our framework, this 
suggests that agent's local state at time m + 1 should be a function of her local state of 
time m and the observation made at time m. We in fact make the stronger assumption 
here that the agent's state consists of the sequence of observations made by the agent. This 
means that the agent remembers all her past observations. Note that this surely implies 
that the agent's local state at time m + 1 is determined by her state at time m and the 
observation made at time m. We make the further assumption that the observations made 
by the agent can be described by formulas in C e . Although this is quite a strong assumption 
on the expressive power of C e , it is standard in the literature: both revision and update 
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assume that observations can be expressed as formulas in the language (see Section 3). 
These assumptions are formalized in BCS2: 

BCS2 For all r G R and for all m, we have r a (m) = (o( rj i), . . . , 0( r ,m)) where 
0( Tj k) G £e for 1 < fc < m. 

Intuitively, 0( r m is the observation the agent makes immediately after the transition from 
time k — 1 to time k in run r. Thus, it represents what the agent observes about the new 
state of the system at time k. Note that BCS2 implies that the agent's state at time is the 
empty sequence in all runs. Moreover, it implies that r a (m + 1) = r a (m) ■ 0( rjm+ i), where • 
is the append operation on sequences. That is, the agent's state at (r, m + 1) is the result 
of appending to her previous state the latest observation she has made about the system. 
It is not too hard to show that belief change systems are synchronous and agents in them 
have perfect recall. (We remark that the agents' local states are modeled in a similar way 
in the model of knowledge bases presented in (Fagin et al., 1995).) 

Clearly we want to reason in our language about the observations the agent makes. 
Thus, we assume that the language includes propositions that describe the observations 
made by the agent. 

BCS3 The language C includes a set <& bs of primitive propositions disjoint 
from $ e such that $ {, s = {learn((p) : ip G C e }. Moreover, n(r,m)(learn((p)) = 
true if and only if 0( rjm ) = (p for all runs r and times m. 

In a system satisfying BCS1-BCS3, we can talk about belief change. The agent's state 
encodes observations, and we have propositions that allow us to talk about what is observed. 
The next assumption is somewhat more geared to situations where observations are always 
"accepted" , so that after the agent observes tp, she believes <p. While this is not a necessary 
assumption, it is made by both belief revision and belief update. We capture this assumption 
here in what is perhaps the simplest possible way: by assuming that observations are 
reliable, so that the agent observes ip only if the current state of the environment satisfies 
(p. This is certainly not the only way of enforcing the assumption that observations are 
accepted, but it is perhaps the simplest, so we focus on it here. As we shall see, this 
assumption is consistent with both revision and update, in the sense that we can capture 
both in systems satisfying it. 

BCS4 (X, r, m) \= 0( r m ) for all runs r and times m. 

Note that BCS4 implies that the agent never observes false. Moreover, it implies that after 
observing (p, the agent knows that <p is true. In (Boutilier et al., 1998), we consider an 
instance of our framework in which observations are unreliable (so that BCS4 does not hold 
in general), and examine the status of R2, the acceptance postulate, in this case. 

Finally, we assume that belief change proceeds by conditioning. While there are certainly 
other assumptions that can be made, as we have tried to argue, conditioning is a principled 
approach that captures the intuitions of minimal change, given the observations. And, as 
we shall see, conditioning (as captured by PRIOR) is consistent with both revision and 
update. 

BCS5 1 satisfies PRIOR. 
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Many interesting systems can be viewed as BCS's. 

Example 4.1: Consider the systems ldiag,i and ldiag,2 of Example 2.1. Are these systems 
BCSs? Not quite, since iidiag is not defined on primitive propositions of the form learn(ip), 
but we can easily embed both systems in a BCS. Let Cdiag the propositional language defined 
over &diag, and let &\ ag consist of Qdiag together with all the primitive propositions of the 
form learn((p) for if £ Cdiag- Let 7r^ aff be the obvious extension of Ttdiag to <f>^ iag , defined so 
that BCS3 holds. Then in it is easy to see that {'R-diagi'n"j iag ,Pdiag,i) is a BCS: we take the 
<l> e of BCS1 to be &diag, and define ^c diag so that it enforces the relationships determined 
by the circuit layout. Thus, for example, if c\ is an AND gate with input lines l\ and I2 
and output line I3, then we would have \~c diag "Vi (^3 /ii A fo)- It is then easy to see 
that BCS2-BCS5 hold by our construction. □ 

These definitions set the background for our presentation of belief revision and belief 
update. 

5. Capturing Revision 

Revision can be captured by restricting to BCSs that satisfy several additional assump- 
tions. Before describing these assumptions, we briefly review a well-known representation 
of revision that will help motivate them. 

While there are several representation theorems for belief revision, the clearest is perhaps 
the following (Grove, 1988; Katsuno & Mendelzon, 1991b). We associate with each belief 
set A a set Wa of possible worlds that consists of those worlds where A is true. Thus, an 
agent whose belief set is A believes that one of the worlds in Wa is the real world. An agent 
that performs belief revision behaves as though in each belief state A she has a ranking, 
i.e., a total preorder, over all possible worlds such that the minimal (i.e., most plausible) 
worlds in the ranking are exactly those in Wa- When revising by ip, the agent chooses the 
minimal worlds satisfying 92 in the ranking and constructs a belief set from them. It is easy 
to see that this procedure for belief revision satisfies the AGM postulates. Moreover, in 
(Grove, 1988; Katsuno & Mendelzon, 1991b), it is shown that any belief revision operator 
can be described in terms of such a ranking. 

This representation suggests how we can capture belief revision in our framework. We 
define C R C C BCS to be the set of belief change systems X = (1Z, tt, V) that satisfy the 
conditions REV1-REV4 that we define below. 

Revision assumes that the world does not change during the revision process. For- 
mally this implies that propositions in <I> e do not change their truth value along a run, 
i.e., (2, r, m) \= p if and only if (I, r, m + 1) \= p for all p £ <3? e . This says that the state of 
the world is the same with respect to the properties that the agent reasons about (i.e., the 
propositions in $ e ). 

REV1 ir(r,m)(p) = 7r(r, 0)(p) for all p£$ e and points (r, m). 

Note that REV1 does not necessarily imply that r e (m) = r e (m + 1). That is, REV1 allows 
for a changing environment. The only restriction is that the truth value of propositions 
that describe the environment does not change. We return to this issue in Section 7. 
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The representation of (Grove, 1988; Katsuno & Mendelzon, 1991a) requires the agent 
to totally order possible worlds. We put a similar requirement on the agent's plausibility 
assessment. Recall that BCS5 says that the agent's plausibility is induced by a prior Pl a ; 
REV2 strengthens this assumption. 

REV2 The prior Pl a of BCS5 is ranked; that is, for all A,B C TZ, either 
Pla(A) < Pl a (B) or Pl a (B) < Pl a (A), and Pl(AuB) = max(Pl(,4), Pl(5)). 

The representation of (Grove, 1988; Katsuno & Mendelzon, 1991a) also requires that 
the agent considers all truth assignments possible. We need a similar condition, except that 
we want not only that all truth assignments be considered possible, but that they have 
nontrivial plausibility (i.e., are more plausible than _L) as well. 

To make this precise, it is helpful to introduce some notation that will be useful for our 
later definitions as well. Given a system 2 and two sequences ipi,. . . ,ip k and o\, . . . , o k > 
of formulas in C e , let TZ[<p\, ■ ■ ■ , <Pk\ oi, . . . , oy] consist of all runs r where for each i with 
1 < i < k, the formula <pi is true at (r,i) and the agent observes o\, . . . ,o k > . That is, 
TZ[ip ,.. . ,¥>fc;oi, . . . ,o k >] = {r £ 1 : (l,r,i) \= ipi, i = 0, . . . , k, and r a (k') = (o 1 , . . .,o k >)}. 
We allow either sequence of formulas to be empty, so, for example, TZ[ip; ■] consists of all 
runs for which <p is true at the initial state. (Note that if REV1 holds, this means that ip is 
true in all subsequent states as well.) We use the notation Tl[<pi, ■ ■ ■ , <p m ] as an abbreviation 
for H[(pi, . . .,(p m ; ■]. 

REV3 If ip G C e is consistent, then Pl a (^[<^]) > !_. 

It might seem that REV1-REV3 capture all of the assumptions made by the representa- 
tion of (Grove, 1988; Katsuno & Mendelzon, 1991a). However, there is another assumption 
implicit in the way revision is performed in these representations that we must make explicit 
in our representation, because of the way we have distinguished observing ip (captured by 
the formula learn((p)) from <p itself. Intuitively, when the agent observes <p, she updates her 
plausibility assessment by conditioning on ip. This is essentially what we can think of the 
earlier representations as doing. However, in our representation, the agent does not condi- 
tion on tp, but on the fact that she has observed ip. Although we do require that <p must 
be true if the agent observes it (BCS4), the agent may in general gain extra information by 
observing ip. 

To understand this issue, consider the following example. Suppose that 1Z is such that 
the agent observes p\ at time (r, m) only if p2 and q are also true at (r, m), and she observes 
pi A p2 at (r, m) only if q is false. It is easy to construct a BCS satisfying REV1-REV3 
that also satisfies these requirements. In this system, after observing p\ , the agent believes 
P2 and q. According to AGM's postulate R7 (and also KM's postulate U5) the agent must 
believe q after observing p\ A p2- To see this, note that our assumptions about TZ can 
be phrased in the AGM language as p2 A q G K o p\ and ^q G K o [pi A P2). Postulate 
R7 states that K o (pi A P2) Q Cl(K o pi U {^2})- Since P2 £ K o p 1; we have that 
Cl(K op\ U {P2}) = K op\. Thus, R7 implies in this case that q G K o (p\ Ap2)- However, in 
TZ, the agent believes (indeed knows) -^q after observing p\Ap2- 8 Thus, revision and update 

8. We stress this does not mean that pi A P2 implies ->q in TZ. There may well be points in TZ at which 
Pi Ap 2 A q is true. However, at such points, the agent would not observe pi Ap2, since the agent observes 
Pi A P2 only if q is false. 
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both are implicitly assuming that the observation of ip does not provide such additional 
knowledge. The following assumption ensures that this is the case for revision (a more 
general version will be required for update; see Section 6). 

REV4 Pla(K[p; o u ..., o m \) > Pl a (K[ip; 01, . . . , o m \) if and only if P\ a (K[y A 
oi A . . . A o rn }) > Pl a (K[ip A 01 A ... A o m }). 

This assumption captures the intuition that observing o± , . . . , provides no more in- 
formation than just the fact that o± A . . . A o m is true. That is, the agent compares the 
plausibility of ip and ip in the same way after conditioning by the observations oi,...,o m 
as after conditioning by the fact that o\ A . . . A o m is true. It easily follows from REV4 and 
PRIOR that the agent believes ip after observing o± A . . . A o m exactly if 0\ A . . . A o m A ip 
was initially considered more plausible than o\ A . . . A o m A ->ip. Thus, the agent believes ip 
after observing o\ A . . . A o m exactly if initially, she believed ip conditional on o\ A . . . A o m : 
the observations provide no extra information beyond the fact that each of the Oj's are true. 

REV4 is quite a strong assumption. Not only does it say that observations do not 
give the agent any additional information (beyond the fact that they are true), it also says 
that all consistent observations can be made (since if ip A o is consistent, we must have 
Pl a (K[(p; o]) = Pl a (7e[t^ A o]) > !_, by REV3 and REV4). We might instead consider using 
a weaker version of REV4 that says that, provided an observation can be made, it gives no 
additional information. Formally, this would be captured as 

REV4' If P\ a {K[p- 01, . . . ,o m ]) > 0, then P\ a {ll[p- o 1 ,...,o m ])> P\ a {n[ip- o 1 ,...,o m \) 
if and only if Pl a (fc[p A o 1 A ... A o m ]) > Pl a (7?# A Oi A ... A o m ]). 

The following examples suggests that REV4' may be more reasonable in practice than 
REV4. We used REV4 only because it comes closer to the spirit of the requirement of 
revision that all observations are possible. 

Example 5.1: Consider the system ldiag,i described in Example 2.1. As discussed in Ex- 
ample 4.1, this system can be viewed as a BCS. Is it a revision system? It is easy to see that 
Zdiag,i satisfies REV2 and REV3. It clearly does not satisfy REV1, since propositions that 
describe input/output lines can change their values from one point to the next. However, 
as we are about to show, a slight variant of Xdiag,i does satisfy REV1. A more fundamental 
problem is that Idiag,i does not satisfy REV4. This is inherent in our assumption that the 
agent never directly observes faults, so that, for example, we have Pl<2iag,iC^-h /i]) = -L, 
while Pl<2iag,i(7^[/i]) > -L. It does, however, satisfy REV4'. 

To see how to modify Idiag,i so as to satisfy REV1, recall that in the diagnosis task, the 
agent is mainly interested in her beliefs about faults. Since faults are static in I d iag,i, we can 
satisfy REV1 if we ignore all propositions except /i, . . . , f n - Let $>' diag = {/i, . . . , f n } and let 
C' diag be the propositional language over $^j 0ff - For every observation o made by the agent 
regarding the value of the lines, there corresponds a formula in C' diag that characterizes all 
the fault sets that are consistent with o. Thus, for every run r in Idiag,i, we can construct 
a run r' where the agent's local state is a sequence of formulas in C' diag . Let 1' diag be the 
system consisting of all such runs r' . We can clearly put a plausibility assignment on these 
runs so that Idiag,i and T' di are isomorphic in an obvious sense. In particular, the agent 
has the same beliefs about formulas in C' diag at corresponding points in the two systems. 
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More precisely, if p € £' diag , then (l' diag ,r,m) \= p if and only if (T diag ^r,m) \= p for all 
points ( satisfies REV1-REV3 and REV4', 

although it still does not satisfy REV4. 

We are not advocating here here using I' diag instead of I d i ag — Idiag seems to us a perfectly 
reasonable way of modeling the situation. Rather, the point is that if we want a BCS to 
satisfy properties that validate the AGM postulates, we must make some strong, and not 
always natural, assumptions. □ 

We want to show that a revision operator corresponds to a system in C R and vice 
versa. To do so, we need to examine the beliefs of the agent at each point (r,m). First 
we note that if (r, m) ~ a (r 1 , m') then (I, r, m) \= Bp if and only if (1, r', m') \= Bp; 
this is a consequence of the requirement that, as we have defined interpreted systems, the 
agent's plausibility assessment is a function of her local state. Thus, we think of the agent's 
beliefs as a function of her local state. We use the notation (I, s a ) \= Bp as shorthand for 
(I,r,m) |= Bip for some (r, m) such that r a {m) = s a . Let s a be some local state of the 
agent. We define the agent's belief set at s a to be 

Bel(J, s a ) = {peC e : {1, s a ) \= Bp}. 

Since the agent's state is a sequence of observations, the agent's state after observing p is 
simply s a ■ p, where • is the append operation. Thus, Bel(Z, s a ■ p) is the belief set after 
observing p. We adopt the convention that if the agent can never attain the local state s a 
in 2, then Bel(J, s a ) = C e . With these definitions, we can compare the agent's belief set 
before and after observing p, that is Bel(X, s a ) and Bel(l, s a ■ p). 

We start by showing that every AGM revision operator can be represented in C R . 

Theorem 5.2: Let o be an AGM revision operator and let K C C e be a consistent belief 
set. Then there is a system I ,k £ C R such that Bel(l ,K, ()) = K and 

Bel{l 0t K, (})oip = Bel(2 , K , (p)) 

for all p G C e . 

Proof: See Appendix A.l. □ 

Thus, Theorem 5.2 says that we can represent a revision operator o in the sense that 
we have a family of systems T Q) k € C R , one for each consistent belief set K, such that 
K is the agent's initial belief set in I ,k, and for each formula p in C e , the agent's belief 
set after learning p is K o p. Notice that we restrict attention to consistent belief set K. 
The AGM postulates allow the agent to "escape" from an inconsistent belief set, so that 
K o p may be consistent even if K is inconsistent. Indeed, R5 requires that it be possible 
to escape from an inconsistent belief set. We might thus hope to extend the theorem so 
that it also applies to the inconsistent belief set, but this is impossible in our framework. If 
false G Bel(I 0> K, So) fo r some state s a , and r a (m) = s a , then P\ r ,m)(W(r,m)) = -L. Since we 
update by conditioning, we must have Pl( r;m +i) (W(r,m+i) ) = -L> so the agent's belief set will 
remain inconsistent no matter what she learns. Although we could modify our framework 
to allow the agent to escape from inconsistent belief sets, we actually consider this to be a 
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defect in the AGM postulates, not in our framework. To see why, suppose that the agent's 
belief set is inconsistent at s a , and r a (m) = s a . Thus, the agent considers all states in 
W( r>m -) to be completely implausible (since P\ r ,m)(^(r,m)) = -L). On the other hand, to 
escape inconsistency, she must have a plausibility ordering over the worlds in W^ m ) . These 
two requirements seem somewhat inconsistent. 9 

Not surprisingly, this inconsistency creates problems for other semantic representations 
in the literature. For example, Boutilier's representation theorem (1992) states that for 
every revision operator o and belief set K, there is a ranking R such that ijj € K o p if and 
only if ip is believed in the minimal 99- worlds according to R. If we examine this theorem, we 
note that he does not state that the minimal (i.e., most preferred) worlds in R correspond 
to the belief set K (in the sense that the minimal worlds are precisely those where the 
formulas in K hold); this would be the analogue of our requiring that Bel(l ,K, ()) = K. 
In fact, if K is h£ e -consistent, the minimal worlds do correspond to K. However, if K is 
inconsistent, they cannot, since any nonempty ranking induces a consistent set of beliefs. 
We could state a weaker version of Theorem 5.2 that would correspond exactly to Boutilier's 
theorem. We presented the stronger result (that does not apply to inconsistent belief sets) 
to bring out what we believe to be a problem with the AGM postulates. See (Friedman & 
Halpern, 1998a) for further discussion of this issue. 

Theorem 5.2 shows that, in a precise sense, we can map AGM revision operations to 
C R . What about the other direction? The next theorem shows that the first belief change 
step in systems in C R satisfies the AGM postulates. 

Theorem 5.3: Let T be a system in C R . Then there is an AGM revision operator oj such 
that 

Bel(l,())o I p = Bel(l, (ip)) 

for all ip £ C e . 

Proof: See Appendix A.l. □ 

We remark that if we used REV4' instead of REV4, then we would be able to prove this 
result only for those formulas (p that are observable (i.e., for which Pl(7£[</?]) > _L). 

Both Theorems 5.2 and 5.3 apply to one-step revision, starting from the initial (empty) 
state. What happens once we allow iterated revision? In our framework, observations are 
taken to be known, so if the agent makes an inconsistent sequence of observations, then 
her belief set will be inconsistent, and (as we observed above) will remain inconsistent from 
then on, no matter what she observes. This creates a problem if we try to get analogues to 
Theorems 5.2 and 5.3 for iterated revision. As the following theorem demonstrates, we can 
already see the problem if we consider one-step revisions from a state other than the initial 
state. 

Theorem 5.4: Let I be a system in C R and let s a = (ip\, ... ,pk) be a local state in I. 
Then there is an AGM revision operator oj Sa such that 

Bel(l, s a ) o ItSa p = Bel(l, s a ■ p) 

9. One strength of the AGM framework is that it can deal with an inconsistent sequence of observations, 
that is, it can cope with an observation sequence of the form (p, ->p,p, ->p, . . .}. We stress that being able 
to cope with such an inconsistent sequence of observations does not require allowing the agent to escape 
from inconsistent belief sets. These are two orthogonal issues. 
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for all formulas ip € C e such that tpi A . . . A ipk A ip is consistent. 
Proof: See Appendix A.l. □ 

We cannot do better than this. If ipi A . . . A A ip is inconsistent then, because of 
our requirements that all observations must be true of the current state of the environment 
(BCS4) and that propositions are static (REV1), there cannot be any global state in X 
where the agent's local state in s a ■ (p. Thus, Bel(X, s a ■ <p) is inconsistent, contradicting R5. 

There is another problem with trying to get an analogue of Theorem 5.3 for iterated 
revision, a problem that seems inherent in the AGM framework. Our framework makes a 
clear distinction between the agent's epistemic state at a point (r, m) in X, which we can 
identify with her local state s a = r a (m), and the agent's belief set at (r, m), Bel(X, s a ), 
which is the set of formulas she believes. In a system in C R , the agent's belief set does 
not in general determine how the agent's beliefs will be revised; her epistemic state does. 
On the other hand, the AGM postulates assume that revision is a function of the agent's 
belief set and observations. Now suppose we have a system X and two points (r, m) and 
(r, m!) on some run r £ X such that (1) the agent's belief set is the same at (r, m) and 
(r, m'), that is Bel(X, r a (m)) = Bel(X, r a (m')), (2) the agent observes ip at both (r, m) and 
(r, m'), (3) Bel(X, r a (m + 1)) / Bel(X, r a (m' + 1). It is not hard to construct such a system 
X. However, there cannot be an analogue of Theorem 5.3 for X, even if we restrict to 
consistent sequences of observations. For suppose there were a revision operator o such 
Bel(X, ( })) o <pi o ■ ■ ■ o (p k = Bel(X, (991, . . . , ipk)) for all (pi , . . . , <pk such that 991 A ... A is 
consistent. Then we would have Bel(X, r a (m + l)) = Bel(X, r a (m))o(p = Bel(X, r a (m'))oip = 
Bel(X, r a (m' + 1)), contradicting our assumption. 

The culprit here is the assumption that revision depends only on the agent's belief set. 
To see why this is an unreasonable assumption, consider a situation where at time the 
agent believes both p and q, but her belief in q is stronger than her belief in p (i.e., the 
plausibility of q is greater than that of p) . We can well imagine that after observing —*p V -<q 
at time 1, she would believe ~^p and q. However, if she first observed p at time 1 and then 

V -<q at time 2, she would believe p and ~^q, because, as a result of observing p, she would 
assign p greater plausibility than q. Note, however, that the AGM postulates dictate that 
after an observation that is already believed, the agent does not change her beliefs. Thus, 
the AGM setup would force the agent to have the same beliefs after learning V ^q in 
both situations. 

There has been a great deal of work on the problem of iterated belief revision (Boutilier, 
1996a; Darwiche & Pearl, 1997; Freund & Lehmann, 1994; Lehmann, 1995; Levi, 1988; 
Nayak, 1994; Williams, 1994)). Much of the recent work moves away from the assumption 
that belief revision depends solely on the agent's belief set. For example the approaches 
of Boutilier (1996a) and Darwiche and Pearl (1997) define revision operators that map 
(rankings x formulas) to rankings. Because our framework makes such a clear distinction 
between epistemic states and belief sets it gives us a natural way of maintaining the spirit of 
the AGM postulates while assuming that revision is a function of epistemic states. Rather 
than taking o to be a function from (belief sets x formulas) to belief sets, we take it o to 
be a function from (epistemic states x formulas) to epistemic states. 

This leaves open the question of how to represent epistemic states. Boutilier and Dar- 
wiche and Pearl use rankings to represent epistemic states. In our framework, we represent 
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epistemic states by local states in interpreted systems. That is, a pair (X, s a ) denotes the 
agent's state in an interpreted system, and the pair determines the agent's relevant epis- 
temic attitudes, such as her beliefs, how her beliefs changed given particular observations, 
her plausibility assessment over runs, and so on. When the system is understood, we simply 
use s a as a shorthand representation of an epistemic state. 

We can easily modify the AGM postulates to deal with such revision operators on 
epistemic states. We start by assuming that there is a set of epistemic states and a function 
BS(-) that maps epistemic states to belief sets. We then have analogues to each of the 
AGM postulates, obtained by replacing each belief set by the beliefs in the corresponding 
epistemic state. For example, we have 

(Rl') E o ip is an epistemic state 

(R2') <p€BS(E<xp) 

(R3') BS{E o <p) c Cl(BS(E) U {(p}) 

and so on, with the obvious transformation. 10 

We can get strong representation theorems if we work at the level of epistemic states. 
Given a language C e (with an associated consequence relation hcj, let £c e consist of all 
finite sequences of formulas in C e . Note that we allow £c e to include sequences of formulas 
whose conjunction is inconsistent. We define revision in 8c e in the obvious way: if E G £c e , 
then E o ip = E ■ <p. 

Theorem 5.5: Let X be a system in C R whose local states are in £c e - There is a function 
BSj that maps epistemic states to belief sets such that 

• if s a is a local state of the agent inX, then Bel(I,s a ) = BSj{s a ), and 

• {o,BS x ) satisfies Rl' -R# . 

Proof: Roughly speaking, we define BSj(s a ) = Bel(T, s a ) when s a is a local state in 2. If 
s a is not in T, then we set BSj(s a ) = Bel(T, s f ), where s' is the longest consistent suffix of 
s a . See Appendix A.l for details. □ 

Notice that, by definition, we have Bel(X, () °i <pi °i ■ ■ ■ °i <Pk) = Bel(X, (<pi, . . . , 
so, at the level of epistemic states, we get an analogue to Theorem 5.3. 

Theorem 5.5 shows that any system in C R corresponds to a revision operator over 
epistemic states that satisfies the generalized AGM postulates. We would hope that the 
converse also holds. Unfortunately, this is not quite the case. There are revision operators 
on epistemic states that satisfy the generalized AGM postulates but do not correspond to 
a system in C R . This is because systems in C R satisfy an additional postulate: 

(R9') If \/ Ce ->(¥> A ip) then BS(E op^) = BS(E o <p A ip). 

We show that R9' is sound in C R by proving the following strengthening of Theorem 5.5. 

10. The only problematic postulate is R6. The question is whether R6' should be "II \~c c <p <^ ip then 
BS(iJ o ip) — BS(E o ip)" or "If h£ e ip <S> ip then E o tp — E o ip" . Dealing with either version is 
straightforward. For definiteness, we adopt the first alternative here. 
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Proposition 5.6: Let Z be a system in C whose local states are Sc e - There is a function 
BSx that maps epistemic states to belief sets such that 

• if s a is a local state of the agent inZ, then Bel(Z,s a ) = BSj(s a ), and 

• {o,BSj) satisfies Rl'-R9 > . 

Proof: We show that the function BSx defined in the proof of Theorem 5.5 satisfies R9'. 
See Appendix A.l for details. □ 

We can prove the converse to Proposition 5.6: a revision system on epistemic states that 
satisfies the generalized AGM postulates and R$ does correspond to a system in C R . 

Theorem 5.7: Given a function BSc e mapping epistemic states in £c a to belief sets over 
C e such that BSc e ({)) is consistent and (BSc e , o) satisfies Rl' -R& ' , there is a system Z £ C R 
whose local states are in £c e such that Z. 

Proof: According to Theorem 5.2, there is a system Z such that Bel(Z, ( )) = BS£ e (( )) and 
Bel(Z, (if)) = BS£ e ({(p)) for all (p € C e . We show that Bel(Z, s a ) = BS£ e (s a ) for local states 
s a in Z. See Appendix A.l. □ 

Notice that, by definition, for the system Z of Theorem 5.7, we have BS(( }o<^ 1 o. . .oip k ) = 
BS ((<£>i, . . . , ifk)) as long as ipi A . . . A ipk is consistent. 

6. Capturing Update 

Update tries to capture the intuition that there is a preference for runs where all the 
observations made are true, and where changes from one point to the next along the run 
are minimized. 

We start by reviewing Katsuno and Mendelzon's semantic representation of update. To 
characterize an agent beliefs, Katsuno and Mendelzon consider the set of "worlds" the agent 
considers possible. In their representation, they associate a world with a truth assignment to 
the primitive propositions. (In our terminology, we can think of a world as an environment 
state.) To capture the notion of "minimal change from world to world", Katsuno and 
Mendelzon use a distance function d on worlds. Given two worlds w and w', d(w, w') 
measures the distance between them. Intuitively, the larger the distance, the larger the 
change required to get from world w to w' . (Note that that distances are not necessarily 
symmetric, that is, it might require a smaller change to get from w to w', than from w' 
to w.) Distances might be incomparable, so we require that d map pairs of worlds into a 
partially ordered domain with a unique minimal element and that d(w, w') = if and only 
if w = w'. 

Katsuno and Mendelzon show that there is a close relationship between update operators 
and distance functions. To make this relationship precise, we need to introduce some 
definitions. An update structure is a tuple U = (W,d, tt), where W is a finite set of worlds, 
d is a distance function on W, and ir is a mapping from worlds to truth assignments for C e 
such that 

• tt(w) is h£ e consistent, 

• if Vc e ""Z 3 ) then there is some w G W with ir(w)(p) = true, and 
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• if w 7^ w' then tt(w) ^ tt(w') for all w, w' G W. 

Given an update structure U = (W, d, tt), we define [<^][/ = {w : 7r(i/;)(y>) = true}. Kat- 
suno and Mendelzon use update structures as semantic representations of update operators. 
Given an update structure U = (W, d, tt) and sets A, B C W, Katsuno and Mendelzon de- 
fine mint/ (A, B) to be the set of worlds in B that are closest to worlds in A, according to 
d. Formally, mmu(A, B) = {w G B : 3w G AVw' G Bd(w ,w') d(w ,w)}. 

Theorem 6.1: (Katsuno &: Mendelzon, 1991b) A belief change operator o satisfies U1-U8 
if and only if there is an update structure U = (W, tt, d) such that 

{if o tpju = min^ (!<£][/, Ml/)- 

Thus the worlds the agent believes possible after updating with ip are these worlds that are 
closest to some world considered possible before learning ip. 

Katsuno and Mendelzon's account of update is "static" in the sense that it describes a 
single belief change. Nevertheless, there is a clear intuition that each world w' G o 
is the result of considering a minimal change from some world w G {(flu- However, in 
Katsuno and Mendelzon's representation, we do not keep track of the worlds that "lead to" 
the worlds in the current belief set. 

We now try to capture behavior similar to Katsuno and Mendelzon's semantics in our 
framework. We define systems where each run describes the sequence of changes, so that the 
most plausible runs, given a set of observations, correspond the worlds that define the belief 
set in Katsuno and Mendelzon's semantics. More precisely, given a sequence of observations 
ipi, . . . , ip n , each world in [yjo^o. . .oip n }u can be "traced" back through a series of minimal 
changes to a world in {(fju- In our model, each such trace corresponds to one of the most 
plausible runs, where the environment state at time m is the mth world in the trace. We 
can capture this intuition by using a family of priors with a particular form. 

We start with some preliminary definitions. Let X be a BCS, and let sq, . . . , s n be a 
set of environment states in X. We define [sq, . . . , s n ] as the set of runs where r e (i) = Sj 
for all < i < n. Thus, [sq, . . . , s n ] describes a set of runs that share a common prefix of 
environment states. A prior plausibility space V a = (H, Pl a ) is consistent with a distance 
measure d if the following holds: 

Pl a ([so, ■ ■ ■ ,Sn]) < Pla([so, • • • , s' n ]) if and only if there is some j < n such that 
s k = s' k for all < k < j, Sj +1 / s' j+1 , and d(sj, Sj+i) < d(sj, s' j+1 ). 

Intuitively, we compare events of the form [sq , . . . , s n ] using a lexicographic ordering based 
on d. Notice that this ordering focuses on the first point of difference. Runs with a smaller 
change at this point are preferred, even if later there are abnormal changes. This point is 
emphasized in the borrowed car example below. 

Pl a is prefix- defined if the plausibility of an event is uniquely defined by the plausibility 
of run-prefixes that are contained in it, so that 

Pl a (Tl[ipo,. . . ,<p m ]) > Pl a (:£[V>o, • • • ,ipm]) if and only if for all [s ,...,s m ] C 

, (p m ] there is some [sg, . . . , s' m ] C TZ\ipQ, • • • , y^m] such 
that Pl„([s , . . . , s' m ]) > Pl„([s , • • • , s m ]). 
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Roughly speaking, this requirement states that we compare events by properties of dom- 
inance. This property is similar to one satisfied by the plausibility measures that we get 
from preference ordering using the construction of Proposition 2.2. 

We define the set C u to consist of BCSs X = (71, ir, V) that satisfy the following four 
requirements UPD1-UPD4. UPD1 says that there are only finitely many possible truth 
assignments, and that there is a one-to-one map between environment states and truth 
assignments. 

UPD1 The set <l> e of propositions (of BCS1) is finite and ir is such that for 
all environment states s, s', if s ^ s', then there is a formula ip € C e such that 
s \= <p and s' \= -><p. 

UPD2-UPD4 are analogues to REV2-REV4. Like REV2, UPD2 puts constraints on 
the form of the prior, but now we consider lexicographic priors of the form described above. 

UPD2 The prior of BCS5 is prefix defined and consistent with some distance 
measure. 

Recall that REV3 requires only that all truth assignments initially have nontrivial plau- 
sibility. In the case of revision, the truth assignment does not change over time, since 
we are dealing with static propositions. In the case of update, the truth assignment may 
change over time, so UPD3 requires that all consistent sequences of truth assignments have 
nontrivial plausibility. 

UPD3 If ifi £ C e , i = 0, . . . , k, are consistent formulas, then Pl^^o, • • • , ¥>fc]) > 
_L. 

Finally, like REV4, UPD4 requires that the agent gain no information from her obser- 
vations beyond the fact that they are true. 

UPD4 Pl a (K[tp , . . . ,ip k+1 ;o 1 , . . . ,o k }) > Pl a (K[ipo, • • • , ipm+i', »i, • • • , o m ]) if 
and only if Pl a (K[ip , (pi Aoi, . . . , tp m Ao m , tp m +i]) > PlaC^o, Ya Aoi, ...,ip m A 
o m , VwiD 

We remark that in the presence of REV1, UPD4 is equivalent to REV4. We might consider 
generalized versions of UPD4, where the two sequences of formulas can have arbitrary 
relative lengths; this version suffices for our purposes. We can also define an analogue 
UPD4' in the spirit of REV4', which applies only if P\(TZ[ipo, . . . , (p m+ \;o\, . . . , o m \) > _L. 

We now show that C u corresponds to (KM) update. Recall that Katsuno and Mendelzon 
define an update operator as mapping a pair of formulas ([/,, <p), where n describes the agent's 
beliefs and ip describes the observation, to a new formula fx o ip that describes the agent's 
new beliefs. However, as we discussed in Section 3, when <£ e is finite, we can also treat o 
mapping a belief set and a formula to a new belief set. Also recall that Bel(X, s a ) is the 
agent's belief set when her local state is s a . 

Theorem 6.2: A belief change operator o satisfies U1-U8 if and only if there is a system 
T € C u such that 

BeliZ, s a ) o ip = Bel(I, s a • ip) 
for all epistemic states s a and formulas tp G C e . 
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Proof: Roughly speaking, we show that any system in C corresponds to a Katsuno and 
Mendelzon update structure. Suppose that I =G C u is such that the set of environment 
states is S e and the prior of BCS5 is consistent with distance function d. We define an 
update structure Uj. We then show that belief change in T corresponds to belief change in 
Uj in the sense of Theorem 6.1. Since Theorem 6.1 states that any belief change operation 
defined by an update structure satisfies U1-U8, this will suffice to prove the "if" direction 
of the theorem. To prove the "only if" direction of the theorem, we show that that for any 
update structure U, there is a system 1 G C u such that Uj = U. 
See Appendix A. 2 for details. □ 

This result immediately generalizes to sequences of updates. 

Corollary 6.3: A belief change operator o satisfies U1-U8 if and only if there is a system 
X<> € C u such that for all ipi, . . . , tpk G C e , we have 

Bel(2 , s a ) o ipi o . . . o ip k = Bel(l<>, s a ■ ipi • • • • • tpk)- 

These results show that for update, unlike revision, the systems we consider are such that 
the belief set does determine the result of the update, i.e., if Bel(X, s a ) = Bel(X, s' a ), then 
for any ip we get that Bel(X, s a ■ ip) = Bel(X, s' a ■ ip). Roughly speaking, the reason is that the 
distance measure that determines the prior does not change over time. While this allows 
us to get an elegant representation theorem, it also causes problems for the applicability of 
update, as we shall see below. 

Note that, since the world is allowed to change, there is no problem if we update by a 
sequence ipi,. . . ,ipk of consistent formulas such that ipi A . . . A ip^ is inconsistent. There 
is no requirement that the formulas ip± , . . . , ipk be true simultaneously. All that matters is 
that ipi is true at time i. Also note that an update by an inconsistent formula does not pose 
a problem for our framework. It follows from postulates Ul and U2 that once the agent 
learns an inconsistent formula (i.e., false), she believes false from then on. 

How reasonable is the notion of update? As the discussion of UPD2 above suggests, it 
has a preference for deferring abnormal events. This makes it quite similar to Shoham's 
chronological ignorance (1988), and it suffers from some of the same problems. Consider 
the following story, that we call the borrowed-car example. 11 At time 1, the agent parks her 
car in front of her house with a full fuel tank. At time 2, she is in her house. At time 3, 
she returns outside to find the car still parked where she left it. Since the agent does not 
observe the car while she is inside the house, there is no reason for her to revise her beliefs 
regarding the car's location. Since she finds it parked at time 3, she still has no reason 
to change her beliefs. Now, what should the agent believe when, at time 4, she notices 
that the fuel tank is no longer full? The agent may want to consider a number of possible 
explanations for her time-4 observation, depending on what she considers to be the most 
likely sequence(s) of events between time 1 and time 4. For example, if she has had previous 
gas leaks, then she may consider leakage to be the most plausible explanation. On the other 
hand, if her spouse also has the car keys, she may consider it possible that he used the car 
in her absence. Update, however, prefers to defer abnormalities, so it will conclude that the 

11. This example is based on Kautz's stolen car story (1986), and is due to Boutilier, who independently 
observed this problem [private communication, 1993] . 
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fuel must have disappeared, for inexplicable reasons, between times 3 and 4. To see this, 
note that runs where the car has been taken on a ride have an abnormality at time 2, while 
runs where the car did not move at time 2 but the fuel suddenly disappeared, have their 
first abnormality at time 4, and thus are preferred! 

Suppose we formalize the example using propositions such as car-parked- outside, fuel- 
tank-full, etc. Let the agent's belief set at time i be fii, i = 1, . . . , 4. Notice that /Ui includes 
the belief that the car is parked in front of the house with a full fuel tank. (That is, 
l~£e Mi =^ fuel-tank- full A car-parked- outside.) At time 2 the agent makes no observations 
since she is in her house, so ^2 = fii o true = fi\ by U2. At time 3 the agent observes 
the car outside her house, so //3 = [i<i o car-parked- outside = fi±, again by U2. Finally, 
M4 = M3 ° ->fuel-tank-fulL The observation of ^fuel-tank-full at time 4 must be explained 
by some means. In our semantics, the answer is clear. The most plausible runs are these 
where the car was parked until time 3, and somewhere between time 3 and 4 some change 
occurred. 

Is this counterintuitive conclusion an artifact of our representation? To some extent 
it is. This issue cannot be formally addressed within Katsuno and Mendelzon's semantic 
framework, since that framework does not provide an account of sequences of changes. 
Moreover, one might argue that within out framework there might be other families of priors 
that satisfy U1-U8, which will offer alternative explanations of the surprising observation 
at time 4. Nevertheless, we claim that our semantics captures, in what we believe to 
be the most straightforward way, the intuition embedded in the Katsuno and Mendelzon's 
representation. In particular, condition UPD2, which enforces the delay of abnormal events, 
was needed in order to capture the "pointwise" nature of the update. It would be interesting 
to know whether there is a natural way of capturing update in our framework that does not 
suffer from these problems. 

Does this way of capturing update semantically ever lead to reasonable results? Of 
course, that depends on how we interpret "reasonable" . We briefly consider one approach 
here. 

In a world w, the agent has some beliefs that are described by, say, the formula ip. These 
beliefs may or may not be correct (where we say a belief ip is correct in a world w if ip is true 
of w). Suppose something happens and the world changes to w' . As a result of the agent's 
observations, she has some new beliefs, described by ip'. Again, there is no reason to believe 
that ip' is correct. Indeed, it may be quite unreasonable to expect ip' to be correct, even if 
ip is correct. Consider the borrowed-car example. Suppose that while the agent was sitting 
inside the house, the car was, in fact, taken for a ride. Nevertheless, the most reasonable 
belief for the agent to hold when she observes that the car is still in the parked after she 
leaves the house is that it was there all along. 

The problem here is that the information the agent obtains at times 2 and 3 is insufficient 
to determine what happened. We cannot expect all the agent's beliefs to be correct at this 
point. On the other hand, if she does obtain sufficient information about the change and 
her beliefs were initially correct, then it seems reasonable to expect that her new beliefs will 
be correct. But what counts as sufficient information? 

We say that <p provides sufficient information about the change from w to w' if there 
is no world w" satisfying <p such that d(w,w") < d(w,w'). In other words, ip is sufficient 
information if, after observing ip in world w, the agent will consider the real world (w') one 
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of the most likely worlds. Note that this definition is monotonic, in that if ip is sufficient 
information about the change, then so is any formula ip that implies ip (as long as it holds at 
w'). Moreover, this definition depends on the agent's distance function d. What constitutes 
sufficient information for one agent might not for another. We would hope that the function 
d is realistic in the sense that the worlds judged closest according to d really are the most 
likely to occur. 

We can now show that update has the property that if the agent has correct beliefs and 
receives sufficient information about a change, then she will continue to have correct beliefs. 

Theorem 6.4: Let X € C u . If the agent's beliefs at (r, m) are correct and oi r ^ m \ provides 
sufficient information about the change from r e (m) to r e (m + f ), then the agent's beliefs at 
(r, m + 1) are correct. 

Proof: Straightforward; left to the reader. □ 

As we observed earlier, we cannot expect the agent to always have correct beliefs. Nev- 
ertheless, we might hope that if the agent does (eventually) receive sufficiently detailed 
information, then she should realize that her beliefs were incorrect. But this is precisely 
what does not happen in the borrowed-car example. Intuitively, once the agent observes 
that the fuel tank is not full, this should be sufficient information to eliminate the possi- 
bility that the car remained in the parking lot. However, it is not. Roughly speaking, this 
is because update focuses only on the current state of the world, and thus cannot go back 
and revise beliefs about the past. 

The problem here is again due to the fact that belief update is determined only by the 
agent's belief set and not her epistemic state. Thus, update can only take into account 
the agent's current beliefs and not other information, such as the sequence of observations 
that led to these beliefs. In our example, if we limit our attention to beliefs about the 
car's whereabouts and the fuel tank, then since the agent has the same belief set at time 1 
and 3, she must change her beliefs in the same manner at both times. This implies that the 
observation the fuel tank is not full at time 4 cannot be sufficient information about the 
past, since a fuel leak might be the most plausible explanation of missing fuel at time 2. 12 

Our discussion of update shows that update is guaranteed to be safe only in situations 
where there is always enough information to characterize the change that has occurred. 
While this may be a plausible assumption in database applications, it seems somewhat less 
reasonable in AI examples, particularly in cases involving reasoning about action. 13 

7. Synthesis 

In previous sections we analyzed belief revision and belief update separately. We provided 
representation theorems for both notions and discussed issues specific to each notion. In 
this section, we try to identify some common themes and points of difference. 

12. In this example the usual intuition is that, given the observation that the tank is not full, the agent 
should revise her belief in some manner instead of performing update. This immediately raises the 
question of how the agent knows what the right belief change operation should be here. We return to 
this issue below. 

13. Similar observations were independently made by Boutilier (1996b), although his representation is quite 
different from ours. 
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Restriction on 


Revision 


Update 


Environment changes 


No change (static propositions) 


All possible sequences 


Initial plausibility 


Total preorder 


Lexicographic 


Belief change 


Conditioning 


Conditioning 



Table 1: A summary of the restrictions we impose to capture revision and update. 



Katsuno and Mendelzon (1991a) focused on the following three differences between AGM 
revision and KM update: 

1. Revision deals with static propositions, while update allows propositions that are not 
static. 

2. Revision and update treat inconsistent belief sets differently. Revision allows an agent 
to "recover" from an inconsistent state after observing a consistent formula. Update 
dictates that once the agent has inconsistent beliefs, she will continue to have incon- 
sistent beliefs. As we noted above, it seems that revision's ability to recover from an 
inconsistent belief set leads to several technical anomalies in iterated revision. 

3. Revision considers only total preorders, while update allows partial preorders. 

Our framework suggests a different approach to categorizing the differences between 
revision and update (and other approaches to belief change): focusing on the restrictions 
that have to be added to basic BCSs to obtain systems in C R and C u , respectively. In 
particular, we focus on three aspects of a system: 

• How does the environment state change? 

• How does the agent form her initial beliefs? What regularities appear in the agent's 
beliefs at the initial state? 

• How does the agent change her beliefs? 

Table 1 summarizes the answers to these questions for revision and update; it highlights 
the different restrictions imposed by each. Revision puts a severe restriction on changes 
of the environment (more precisely, on how we describe the environment in the language) 
and a rather mild restriction on the agent's prior beliefs (they must form a total preorder). 
On the other hand, update allows all sequences of environment states, but requires the 
agent's prior beliefs to have a specific form. These formal properties match the intuitive 
description of revision and update given in (Alchourron et al., 1985; Katsuno & Mendelzon, 
1991b). However, the explicit representation of time in our framework allows us to make 
these intuitions precise. Moreover, our framework makes explicit other assumptions made 
by revision and update. For example, the lexicographic nature of update is not immediately 
evident from the presentation in (Katsuno & Mendelzon, 1991b). 
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The key point to notice in this table is that belief change in both revision and update 
is done by conditioning. This observation, and the naturalness of conditioning as a notion 
of change, support our claim that conditioning should be adopted as semantic foundations 
for minimal change. 

How significant are the differences between revision and update? We claim that some 
of these differences are a result of different ways of modeling the same underlying process. 
Recall that in the introduction we noted that the restriction to static propositions is not such 
a serious limitation of belief revision, since we can always convert a dynamic proposition 
to a static one by adding timestamps. More precisely, we can replace a proposition p by a 
family of propositions p m that stand for u p is true at time m" . This makes it possible to 
use revision to reason about a changing world. We now show how revision and update can 
be related under this viewpoint. 

To make this discussion precise, we need to introduce some formal definitions. Let 
I = (1Z,tt,P) be a BCS. We "statify" 1 into a system 2* = {TV ,vr* ,V*) by replacing the 
underlying language with static propositions. 

Let <3>* = {p m : p G <I> e , to G JV} be a set of timestamped propositions and let C* e be the 
logical language based on these propositions. We can easily "timestamp" every formula in C. 
We define timestamp (<p, to) recursively as follows. The base case is timestamp (p, m) = p m 
for p£ $ e . For standard logical connectives, we simply apply the transformation recursively, 
for example timestamp((/? A ip) = timestamp^, to) A timestamp^, to). 

Next, we define the set of runs in the "statified" system. For each run r G 7Z, we 
define a r* in 1Z* as follows. The environment states in r* are defined to be the whole 
sequence of environment states in r, that is, r*(m) = r e . If r a {m) = (o( r l ), . . . , 0( ri?n )), we 
define r a (m) = (timestamp (o( r l ), 1), . . . , timestamp (o( r m ), to)). We define the interpreta- 
tion 7r* in the obvious way: ir*(r*, m)(p m ') = true if and only if ir(r,m')(p) = true and 
7r*(r* ,m)(learn(ip)) = true if and only if 0( r *^ m \ = (p. 

Finally, we need to define the prior plausibility PI*. We define this prior to be isomorphic 
to Pl a under the transformation r* ^ r. That is, for each set of runs R* C 7Z*, we define 
Pl* a {R*) = Pl a ({r eTZ-.r* G R*}). 

It is clear that the two systems X and X* describe the same underlying process. Perhaps 
the most significant difference is that the environment state in a run of I* encodes the 
future of the run. This was necessary so that the environment state could determine the 
truth of all propositions of the form p m , so as to satisfy BCS1. Without this requirement, 
we could have simply changed ir and left 1Z and V unchanged. 

Because different base languages are used in I and I*, the agent has different beliefs 
in the two systems. It is easy to show that, for all (p G C e , we have (I,r,m) \= Bip iff 
(2*,r*,m) \= B (timestamp (ip, to)). However, at (r*,m) the agent also has beliefs about 
propositions that describe past and future times. Thus, the set of beliefs of the agent in I* 
can be viewed as a superset of her beliefs in I at the corresponding points. 

The following result makes precise the relationship between I and I* in terms of the 
properties we have been considering. 

Proposition 7.1: Let 1 be a BCS and letl* the transformed system defined above. Then 

• Z* is a BCS, that is, it satisfies BCS1-BCS5. 

• 1* satisfies RE VI. 
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• If 2 satisfies UPD3, then 1* satisfies REVS. 

• If 2 satisfies UPD4, then 2* satisfies REV4' ■ 

Proof: Straightforward; left to the reader. □ 

Thus, if 2 is a BCS, so is 2*. Moreover, if 2 € C u , then 2* satisfies all but two of the 
requirements for C R . First, 2* does not necessarily satisfy REV2, since the prior of systems 
in is, in general, not ranked. Second, 2* satisfies REV4', the weaker version of REV4. 
The reason for this is that runs 2* do not allow all sequences of possible observations. 
Remember that in the language of £*, the agent can observe the proposition p 2 (i.e., that 
p is true at time 2) at time 1. However, in the original system, the agent only observes 
properties of the current time. Thus, 0( r » m ) involves only propositions that deal with time 
m. 

Neither of these shortcomings is serious. First, variants of AGM revision that involve 
partial orders were discussed in the literature (Katsuno & Mendelzon, 1991b; Rott, 1992). 
It is fairly straightforward to show that these can captured in our systems using BCSs that 
satisfy REV1, REV3, and REV4. Second, it is easy to add to 2* runs so as to get a system 
that satisfies REV4. Moreover, we can do this is a way that does not change the agent's 
beliefs for sequences of observations that can be observed in 2. Thus, the "statified" version 
of a system in C u displays behavior much in the spirit of belief revision. 

This result may seem somewhat surprising in light of the significant differences between 
the AGM postulates and KM postulates. In part, it shows how much is bound up in our 
choice of language. (Recall that similar issues arose in Example 5.1.) This highlights the 
sensitivity of the postulate approach to the modeling assumptions we make. Unfortunately, 
these modeling assumptions are rarely discussed in the belief change literature. (See (Fried- 
man & Halpern, 1998a) for a more detailed discussion of this point.) 

Table 1 emphasizes that, despite the well-known differences between revision and update, 
they can be viewed as sharing one very important feature: they both use conditioning to do 
belief change. Thus, we have a common mechanism both for understanding and extending 
them. To a certain extent, our results show that revision is more general than update, in 
the sense that we can view the statified version of any system in C u as performing revision 
(possibly with unranked prior) over runs. 

8. Extensions 

In the preceding sections, we introduced several assumptions that were needed to capture 
revision and update. Of course, there are other ways of capturing these notions that require 
somewhat different assumptions. Nevertheless, these assumptions give insight into the un- 
derlying choices made, either explicitly or implicitly, in the definition of revision and update. 
In addition, thinking in terms of such restrictions makes it straightforward to extend the 
intuitions of revision and update beyond the context where they were originally applied. In 
this section, we consider a number of such extensions, to illustrate our point. 
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8.1 Knowledge 

In many domains of interest, the agent knows that some sequences of observations are 
impossible. We already saw in the circuit-diagnosis problem that observing failures was 
impossible. In the context of update, we know that we cannot observe a person die and 
then be alive, despite the fact that both being dead and being alive are consistent states. 

We can easily maintain what we regard as the defining properties of revision and update, 
as discussed in the previous section: no change in the environment state and a ranked prior 
in the case of revision, and a lexicographic prior in the case of update, with belief change 
proceeding by conditioning in both cases. We simply drop REV3 and replace REV4 by 
REV4' (resp., drop UPD3 and replace UPD4 and UPD4'). We remark that this change 
affects the postulates. For example, consider update. Suppose that the agent considers 
the possibility that Mr. Bond is dead. If she then observes Mr. Bond alive and well then, 
according to update, she must account for the new observation by some change from the 
worlds she previously considered possible. However, there is no transition from worlds 
in which Mr. Bond is dead that can account for the new observation. Thus, once the 
agent knows that certain transitions are impossible, some observations (e.g., observing that 
Mr. Bond is alive) require her to remove from consideration some of the worlds that she 
previously considered possible. As a consequence, postulate U8 does not hold, since the 
agent's new beliefs are not determined by a pointwise update at each of the worlds she 
previously considered possible. (Boutilier (1998) uses a related semantic framework to 
draw similar conclusions in his analysis of update.) 

8.2 Language of Beliefs 

In our analysis of revision and update, we focused on the agent's beliefs about the current 
state of the environment. Often we are also interested in how the agent changes her beliefs 
about other types of statements, such as beliefs about future states of the environment, 
beliefs about other agents' beliefs, and introspective beliefs about her own beliefs. Again, 
it is straightforward in our framework to deal with an enriched language that lets us ex- 
press such statements. For example, in (Friedman & Halpern, 1994) we examine Ramsey 
conditionals. These are formulas of the form ip > tp, which can be read as saying "after 
learning ip, the agent believes ip" . This formula can be expressed as learn((p) Bip in the 
language C KPT . As is well known, if belief sets include Ramsey conditionals (and not just 
propositional formulas), then the AGM postulates become inconsistent (at least, provided 
we have at least three mutually exclusive consistent formulas in the language) (Gardenfors, 
1986). Similar inconsistency results arise when one tries to add other forms of introspective 
beliefs (Fuhrmann, 1989). In our setting, it is easy to see why the problem arises. Even 
if we allow belief sets to include nonpropositional formulas, it still seems quite clear that 
we want to distinguish the propositional formulas from formulas that talk explicitly about 
an agent's beliefs. For example, it is not clear that we should allow an observation of a 
formula such as cp > i/j. What would it mean to observe such a formula? It clearly seems 
quite different from observing a propositional formula. Nor does it make sense to extend an 
assumption such as REV1 to arbitrary formulas. While it may be reasonable to restrict to 
static propositions if we are viewing these as making statements about a relatively stable 
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environment, it seems far less reasonable to assume that formulas that talk about an agent's 
beliefs will be static, especially when we are trying to model belief change! 

Of course, if we allow only propositional formulas to be learned (or observed), and 
restrict REV1 to propositional formulas, then it is easy to see that all of our results still 
hold, even if the full language is quite rich; we avoid the triviality result completely. 

8.3 Observations 

One of the strongest assumptions made by revision and update involves the treatment of 
observations. This assumption seems unreasonable in most domains. REV4 and UPD4 
essentially assume that the observation that the agent makes is chosen randomly among 
all formulas consistent with the current state of the world. Suppose that ip says that the 
agent is outdoors, ip says that the agent is in the basement, and o\ says that the basement 
light is on. We may well have Pl a (1Z[(p A o±]) > V\ a (lZ[ip A 01]). For example, the agent 
may hardly ever go to the basement and frequently go outdoors, but her children may often 
leave the basement light on. Nevertheless, we may also have P\ a (lZ[ip; 01]) < Pl a (7£[^; oi]), 
contradicting REV4. Indeed, it may well be impossible for the agent to observe that the 
basement light is on when she is outdoors, so that P\ a (lZ[(p; o±]) = _L, but this is not 
permitted according to REV4 or UPD4. 

In many domains it is useful to reason about hidden quantities that simply cannot be 
observed. For example, the event that component a is faulty in Example 5.1 is a basic 
event in our description of the problem, yet it cannot be observed. Similarly, the event 
where a patient has a disease X or the opponent is planning to capture the queen are useful 
in reasoning about medical diagnosis and game strategy, yet are not directly observable in 
practice. Thus, the requirement that all formulas in the language can be observed seems 
quite unnatural. We note that explicitly modeling sensory input is a standard practice in 
control theory and stochastic processes (e.g., in hidden Markov chains). In these fields, 
one models the probability of an observation in various situations. Making an observation 
increases the probability of situations where that observation is likely to be observation and 
decreases the probability of situations where it is unlikely. Again, it is straightforward to 
consider a more detailed model of the observation process in our framework; see (Friedman, 
1997, Chapter 6) and (Boutilier et al., 1998). 

8.4 Actions 

Our definition of belief change systems essentially assumes that the agent is passive. The 
situation is more complex when the agent can influence the environment. The agent's choice 
of action interacts with her beliefs. It is clear that after performing an action, the agent 
should change her beliefs. 14 Moreover, the information content of observations depends on 
the action the agent has just performed. For example, the agent might consider hearing a 
loud noise to be surprising. However, it would be expected after the agent pulls the trigger 
of her gun. 



14. Indeed, an alternative interpretation of the update postulates is that they describe how the agent should 
update her beliefs after doing the action "achieve y" (Goldszmidt & Pearl, 1996; del Val & Shoham, 1992, 
1993). However, as these works show, the update postulates are problematic under this interpretation. 
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8.5 Summary 

This list of possible extensions is clearly not exhaustive; there are many others that we 
may want to consider. Nevertheless, these are extensions that seem to be of interest. The 
main points we want to make here are (1) it is easy to accommodate these extensions in 
our framework while still maintaining the main characteristics of revision and update, and 
(2) it is difficult to deal with such extensions if we focus on postulates. 

9. Conclusion 

We have shown how the framework introduced in (Friedman & Halpern, 1997) can be used 
to capture belief revision and update. Modeling revision and update in the framework also 
gives us a great deal of further insight into their properties, and emphasizes the role of 
conditioning as a way of capturing minimal change. 

Of course, revision and update are but two points in a wide spectrum of possible types of 
belief change. Our ultimate goal is to use this framework to understand the whole spectrum 
better and to help us design belief change operations that overcome some of the difficulties 
we have observed with revision and update. In particular, we want belief change operations 
that can handle dynamic propositions, while still being able to revise information about the 
past. 

Our framework suggests how to construct such belief change operations. In this frame- 
work, belief change operations can be determined by choosing a plausibility measure that 
captures the agent's preferences among sequences of worlds. This is the agent's prior plau- 
sibility, and captures her initial beliefs about the relative likelihood of runs. As the agent 
receives information, she changes her beliefs using conditioning. In this paper we show that 
revision and update correspond to two specific families of priors. Clearly, however, there 
are prior plausibilities that, when conditioned on a surprising observation, allow the agent 
to revise some earlier beliefs and to assume that some change has occurred. One obvious 
problem is that, even if there are only two possible states, there are uncountably many 
possible runs. How can an agent describe a prior plausibility over such a complex space? 

One approach to doing this is based on intuition from the probabilistic settings. In 
these settings, the standard solution to this problem is to assume that state transitions are 
independent of when they occur, that is, that the probability of the system going from state 
s to state s' is independent of the sequence of transitions that brought the system to state 
s. This Markov assumption significantly reduces the complexity of the problem. All that 
is necessary is to describe the probability of state transitions. In (Friedman & Halpern, 
1996; Friedman, 1997) we define a notion of plausibilistic independence, and show how to 
describe priors that satisfy the Markov assumption and the consequences for belief change. 
See also (Boutilier, 1998; Boutilier et al., 1998) for recent proposals along these lines. 

Whether or not this particular approach turns out to be a useful one, it is clear that 
these are the types of questions we should be asking. As these works show, our framework 
provides a useful basis for answering them. 

Finally, we note that our approach is quite different from the traditional approach to 
belief change (Alchourron et al., 1985; Gardenfors, 1988; Katsuno & Mendelzon, 1991a). 
Traditionally, belief change was viewed as an abstract process. Our framework, on the other 
hand, models the agent and the environment she is situated in, and how both change in time. 
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This allows us to model concrete agents in concrete settings (for example, diagnostic systems 
are analyzed in (Friedman & Halpern, 1997) and throughout this paper), and to reason 
about the beliefs and knowledge of such agents. We can then investigate what plausibility 
ordering induces beliefs that match our intuitions. By gaining a better understanding of 
such concrete situations, we can better investigate more abstract notions of belief change. 
More generally, we believe that, when studying belief change, it is important to specify the 
underlying ontology: that is, exactly what scenario underlies the belief-change process. We 
have specified one such scenario here. While others are certainly possible, we view it as a 
defect in the literature on belief change that the underlying scenario is so rarely discussed. 
The framework we have introduced here provides a way of making formal what the scenario 
is. (See (Friedman & Halpern, 1998a) for further discussion of this issue.) 
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Appendix A. Proofs 
A.l Proofs for Section 5 

We start with the proof of Theorems 5.2 and 5.3. To do this, we need some preliminary def- 
initions and lemmas. Figure 1 shows the general outline of the intermediate representations 
we use in these proofs. Roughly speaking, we show how to map from a revision operator o 
and a consistent belief set K to a ranking, and similarly how to map from a ranking to an 
AGM revision operator. These rankings correspond, in a direct way, to priors in systems in 
C R , and thus have close connection to the beliefs of the agent in various states. 

These mapping between AGM revision operators and rankings are related to the repre- 
sentation theorems of Boutilier (1994b), Grove (1988), and Katsuno and Mendelzon (1991a). 
However, the exact details of our representations are different than those of Boutilier, Grove, 
and Katsuno and Mendelzon. Thus, for completeness we provide the full proofs here. 

We start with the mapping from revision operator applied to a specific belief set to a 
ranking. As an intermediate step we construct a set of defaults as follows. We then will use 
the results from (Friedman & Halpern, 1998b) to construct a ranked plausibility structure 
that satisfies these defaults. 
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Figure 1: Schematic description of the entities and lemmas involved in the proof of Theo- 
rems 5.2 and 5.3. 



Lemma A.l: Let o be an AGM revision operator, let K C £ e be a consistent belief set, 
and let 

A (o,K) = {<£>— »^ ■ <P, i> G C e , ip G K o ip}. 
Then the following is true: 

(a) A( ^) is closed under the rules of system P ; 

(b) p — ► false G" A( ^) for all consistent p G C e , and 

(c) ^( ,K) satisfies rational monotonicity; that is, if ip — >ip G ^(o,k) an d V 7 — ^{o,k)> 
then (p A £— >ip G A/ 0jK \. 

Proof: We start with part (a): 

LLE Assume that hc e ip = ip' and that (p — tip G A( Thus, ip G K o <p. From R5, it 
follows that ip G K o <p' : and thus <p' — >ip G A/ ^). 

RW Assume that \~c e ip ^ ip' and that p — >ip G A( K y Thus, ip G K o <p. Since K o <^ is a 
belief set, it is closed under logical consequence. In particular, ip' G if o ip, and hence 

REF By R2, ip G K o and thus, (/?— >-<p G &(p,K)- 

AND Assume that ip^np\,ip^np2 G A/ ^). Thus, ipi,ip2 G K o ip. Since K o ^ is a belief 
set, ipi Aip2 € K o ip. Thus, ip^-ipi A V>2 G A( 

OR Assume that </?i — >ip-,p2 — ^ G A/ 0) ^. There are two cases. If o V 922) is 
inconsistent, then ^ G K o (<pi V^) and thus <p\\l P2 — ^ £ a (o,_k)- If (</?i V</?2) is 
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consistent, then, by R2, 991 V 992 G if o (ipi V ^2)- Thus, we cannot have both -npi and 
—«P2 in Ko V 992). Without loss of generality, assume that —np\ G" if o (^ V (^2)- 
Using R7 and R8, we get that if o ((^ V <p 2 ) A <^i) = C7(if o (991 V 992) U {991}). 
Using R6, we get that if o ((99! V (^2) A 991) = if o 991. Thus, we conclude that 
K o(pi = Cl(K o V (^2) U {v9i}). Since 991 — ^ G A( 0j jn, we have that ip & K o <pi. 
Thus, we get that ipi => ip G Ko(<pi V^)- If """^ if °(¥>i Vv9 2 ), by similar arguments 
we get that ip2 => ip G if o (99! V 992)- This implies that (991 V p>2) => ip G if o (</?! V 992), 
and thus ip G if o (991 V 992). On the other hand, if -xp2 G if o V 992), then, since 
V?i V 992 G if o V (£2), we get that 991 G if o V P2), and thus ip e K o (ip 1 V ^2)- 

CM Assume that p— tipi, ip— >ip2 G A< oK y If if o 99 is inconsistent, then using R5 we get 
that ip is inconsistent. Thus, <pAipi is inconsistent, so ip2 G if 0(99 A ipi). Now assume 
that if o p is consistent. Since ip — *ipi, we have that ipi G if o p. Since if o ip is 
consistent, we get that ~^ip\ G" if o p>. Applying R8, we get that if o p C if o (ip Aipi). 
Since ip—*ip2 G A( 0j k), we have that ip2 G if o ip. Thus, ^2 G if o (ip A V'l)- This 
implies that (99 A ipi)—*ip2 £ ^-(o,k)- 

We now prove part (b). Let 99 G £ e be a consistent formula. Then, using R5, we get 
that if o ip is consistent. Thus, ip — ► false G" Ai ^y 

Finally we prove part (c). Assume that ip — tip G A( o A -), and p A £ — tip G" A( 0jK y Since 
99— >-Y> £ A( Dj jn, we have that ^ G if o 99. Now if ->£ G" if o 99, then, using R8, we have that 
Cl(Koip(j{^}) C if o(^A^). This implies that ip G if o(^9A£). However, since we assumed 
that ip A £— >V> ^ ^(o,A")) we have that ^ G" if o (p A £); thus, we get a contradiction. We 
conclude that ->£ G if o ip. Thus, ip — G A( Q C 

We now use this result to show that there exists a plausibility structure that corresponds 
to o applied to if. 

Lemma A. 2: Let o be an AGM revision operator, and let if C £ e be a consistent belief set. 
Then there is a plausibility structure PL = (W, PI, 7r) such that PI is ranked, PL \= ip^tip if 
and only if ip G if o ip, and Pl({p}) > _L for all h c e - consistent formulas ip G C e . 

Proof: We use the basic techniques described in the proof of (Friedman & Halpern, 1998b, 
Theorem 8.2). Let A( o ft: ) be the set of defaults defined by Lemma A.l. We now construct 
a plausibility space PL' = (W, Pl',7r) such that PL' \= ip^tip if and only if ip^tip G A( o K y 
We define PL' as follows: 

• W = {wy '■ V C C e is a maximal \~c e -consistent set}, 

• n(wy){p) = true if p G V, and 

• Pl'(b]) > Pl'(M) if and only if (p V p G A (o>K) . 

Using (Friedman & Halpern, 1998b, Lemma 4.1), we get that PL' |= 99 — tip if and only if 
p> — tip g A( 0j x)- From Lemma A.l (c) and and results of (Friedman & Halpern, 1998b), it 
follows that there is a ranked plausibility measure PI that is default-isomorphic to Pi', that 
is (W, Pl,7r) satisfies precisely the same defaults as (W, Pl',vr). Let PL = (W, PI, it). 

Since PL is default-isomorphic to PL', we have that PL \= ip — tip if and only if ip — tip g 
A( Q xy Moreover, using Lemma A.l, we have that ip — tip g A( 0j x) if and only if ip G if o p. 
Thus, PL \= ip — tip if and only if ip G K op. Finally, let p be a \~c e -consistent formula. From 
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Lemma A.l (b), we get that ip — ► false Ar o K y Since A( ,k) 1S closed under the rules of 
system P, we conclude that (ip V false)— tfalse g" ^(o,k)- Thus, Pl'([y]) % -L = Pl'dfalse}), 
and thus Pi' ([</?]) > _L. Since PI is default-isomorphic to Pi', we conclude that Pl( [</?]) > J_. 
□ 

We now prove the converse to Lemma A. 2. 

Lemma A. 3: Let PL = (W, PI, it) be a ranked plausibility structure such that tt(w) is h (in- 
consistent for all worlds w, and PL \/= <p — > false for all \~c e - consistent formulas ip G C e ; 
let K = {ip G C e : PL \= true — ►</?}. Then there is an AGM revision operator o such that 
ip G K o ip if and only if PL \= ip — tip. 

Proof: Let o be some belief change operation such that K o <p = {ip : PL \= ip — yip}. Since 
this requirement constrains only the result of applying o to K, we can assume without loss 
of generality that o satisfies the AGM postulates when applied to belief sets other than K. 
Thus, we need prove only that o satisfies the AGM postulates for revision applied to K. 
(Note that the proofs for R3 and R4 follow from the proofs for R7 and R8, respectively.) 

Rl Since PL is qualitative, we have that {ip : PL \= ip—np} is a belief set, that is, closed 
under logical consequences. 

R2 Axiom CI implies that PL \= ip — >ip. Thus, ip G K o ip. 

R5 By our assumptions, if ip is \~c e -consistent, then Pl( [</?]) > -L, and thus PL \/= ip — >false. 
On the other hand, if ip is not l~£ e -consistent, then \p\ = 0, and thus Pl( [<£>]) = -L. 
We conclude that Pl( [</?]) = _L if and only if \~c e ^<P- This implies that PL |= ip — > false 
if and only if \~c e -^<P- Thus, K o ip = CI (false) if and only if \~c e -^<P- 

R6 Assume that \~c e ip p' ■ Then, by our assumption, n(w)(<p) = ir(w)(ip'). Thus, 
[pAi/)] = {ip' A ip\ for all formulas ip G C e . We conclude that PL \= <p—np if and only 
if PL |= ip' — >ip. This implies that K o ip = K o ip' . 

R7 There are two cases: either Y>\(\ip A ip\) = _L or Pl([<p A ipj) > _L. If Pl([^ A ip}) = 
_L, then ip A ip is inconsistent. According to R2, we have that p G K o ip. Thus, 
p A ip G Cl(K o ip u {ip})- This implies that Cl(K o^u {ip}) contains false, and thus 
Ko(ipAip)Q Cl(KopU{ip}). If Pl([</?A-0]) > _L, let £ G K o (ip Aip). We now show 
that £ G Cl(K o ip u {ip}). This will show that K o (ip Aip) C o 99 U {?/>}). Since 

£ G if o (ip A ip), we get that PL (= (99 A ?/>)—►£. Since Pl([y A VI) > -L, we get that 
P1([</?A<0A£]) > PldvcA^A^]). Then we have that Pl([vcA(^ =► £)]) > Pl([<pA-i(^ =► 
£))]), since (99 A V A ^ (99 A (V ^ 0) and (<P A 0) fa A V> A -0- This 

also implies that Pl( [</?]]) > -L. Thus, PL |= £). So > =^ G K o ip, and 

thus£ G Cl(K o(p(j {ip}). 

R8 Assume that ^ K o(p. Let £ G C7(AT o ip U {?/>}). We now show that £ G K o (pAip). 
This will show that Cl(K oipU{ip}) C Ko(ip/\ip). Let A = [pA-i^], # = [<pAV>A£], 
and C = [</? A ^ A -i£]. It is easy to verify that these sets are pairwise disjoint. Since 
p> A (ip => £) = (ip A -<ip) V (ipAip A£) and (ipA->(ip =>• £)) = (</? A ^ A ->£), we conclude 
that [92 A (V> =^ £)] = A U 5, and A =► £)] = Since f G {^}), 
we have that (V 7 => £) G K o ip. This means that PL |= 99 — ^(^ =^ £)• Thus, either 
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P1(M) = _L or P\(AliB) > P1(C). If P1(M) = -1, then according to Al, we get that 
Pl([y A ip}) = _L. Thus, PL \= (ip A ip) — vacuously, and £ G K o (ip Aip) as desired. 

Now assume that P1(A UB) > P1(C). Since PI is ranked, it satisfies A4' and A5'. 
According to A5', we get that either P1(A) > P1(C) or Pl(-B) > P1(C). Assume that 
P1(A) > P1(C) and P1(B) J* P1(C). Then, using A4', we get that P1(A) > P1(B). 
Applying A2, we get that Pl(A) > Pl(B U C). However since A = {ip A ->^j and 
B U C = \(p A V'l) this implies that G AT o which contradicts our assumption. 
Thus, we conclude that Pl(B) > P1(C). Since B = [<p A i/> A £] and C = [<p A ^ A -.£], 
we get that |= A ^)— >£, and thus £ <G AT o (99 A ^). 

R3 and R4 Our definition of o implies that A o irae = K. According to R6, we have that 
K o {true A ip) = Koip. Combining these two facts, we get that R3 and R4 are special 
cases of R7 and R8, respectively. 

□ 

These results show how to map between ranked plausibility structures and AGM revision 
operators. We now relate systems in C R and ranked plausibility structures. Let X = 
(TZ,tt,V) G C R . Recall that REV2 requires that the prior of X be a ranking. Thus, we 
can construct a ranked plausibility structure where worlds are runs in 1Z. We define the 
characteristic structure of X to be PLj = (1Z, Pl a , ""Pix), where Pl a is the agent's prior over 
runs and irp\ x (r)(p) = ir(r, 0)(p) for all p G <E> e . Note that [^Jplj = TZ[(p}. 

We now use PLj to describe the beliefs of the agent in each local state. 

Lemma A. 4: Let X G C R and let s a = (o±, . . . ,o m ). Then ip G Bel(X,s a ) if and only if 
PLi \= (Ki=i °i) — *<P- (By convention, if m = 0, we take (A^Li Oj) to be true.) 

Proof: Let X G C R and let s a = (o±, . . . , o m ). There are two cases: either s a is a local state 
in X, or it is not. 

If s a is a local state in X, suppose that r a (m) = s a . Note that <p G Bel(X, s a ) if and 
only if Pl( r ,m)(M(r,m)) > Pl(r,m) ( I -1 ^] (r,m) ) • Recall that, according to the definition of 
conditioning, Pl (j . jm) (-) is isomorphic to Pl a (-|7£[-; 01, . . . , o m ]). Thus, Pl( r ,m)(M(r,m)) > 
pl (r,m)(h^l(r,m)) if and only if Pl (7£[ip] | 7£[-; 01, . . . , o m ]) > Pl a (7£[^] \ K[; 01, . . . , o m ]). 
Using CI, this is true if and only if Pl a (7?.[<p; 01, . . . , o m ]) > Pl a (7?.[-i(^; 01, . . . , o m ]). Using 
REV4, this is true if and only if Pl a (7e[^ A A£Li oA) > Pla(^hv A A™ 1 Oi]). We get that 
tp G Bel(X, a a ) if and only if Pl a (K[tp A AELi oA) > Pla (ft hp A A™ 1 oj). This implies that 
ip G Bel(X, So ) if and only if PL X \= (A™ 1 <*)-►¥>. 

If s a is not a local state inX, then 1Z[-; 01, . . . , o m ] = 0, and by definition Pl a (72.[-; 01, . . . , o m ]) = 
_L. Using CI and REV4, we get that PZ, (ft[A™ 1 o*]) = _L, and thus PLj \= (A™i o;)— 
for all ip G £ e . Since s a is not a local state in X, by definition Bel(X, s a ) = C e . Hence, we 
can conclude that tp> G Bel(X, s a ) if and only if PLj \= (A^=i ¥l P- a 

We now show that given a ranked plausibility structure PL we can construct a system 
whose characteristic structure is default-isomorphic to PL. 

Lemma A. 5: Let PLk = (Wk, PIr", ttk) be a plausibility space that satisfies the conditions 
of Lemma A. 3. Then there is a system X G C R such that PL X = PL K . 
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Proof: Let PLk = (Wk,P^k,^k) be a plausibility space that satisfies the conditions of 
Lemma A. 3. For each world w G Wk and sequence of observations o\, 02, . . ., let r w >°i>°2>--- 
be the run defined so that r™' 0l ' 02 '"'(m) = w and r^' 01 '° 2 '"'(m) = (01, . . . , o m ) for all m. Let 
7£ = 1^,01,02,... . 7r fc (it;)(oj) = true for all i}. Define n so that ir(r,m)(p) = (r e (m) ) (p) 
for p G <£ e , and so that ir(r 1 m)(learn((p)) = true if 0( r m ) = ip for </? G £ e . Finally, define 
the prior plausibility Pl a so that Pl a (i?) = PLy({u> : 3r G R(w = r e (0))}. It is easy to check 
that this definition implies that Pl a (7£[<^]) = P1r-([M|pLk ). Thus, PLj = PLk- Since PIr- 
is a ranking, Pl a is also a ranking and thus qualitative. 

We now verify that the resulting interpreted system is indeed in C R . It is easy to 
check that I is a belief change system; that is, it satisfies BCS1-BCS5. The construction 
is such that r e (m) = r e (0) for all runs r and times m. Thus, T satisfies REV1. Since 
the prior Pl a is a ranking, this system also satisfies REV2. Lemma A. 2 implies that if ip 
is a consistent formula, then Pl^ ([(^]pl k ) > L. This implies that Pl a (TZ[(p}) > _L, and 
thus the system satisfies REV3. Finally, it is easy to show that Pl a (7Z[<p; o\, . . . , o m ]) = 
?\ a (1Z[(p A 01 A ... A o m ]) = P1rt([<£> A Oi A ... A o m \pL K ). Thus, the system satisfies REV4. 
□ 

We are finally ready to prove Theorem 5.2. 

Theorem 5.2: Let o be an AGM revision operator and let K C C e be a consistent belief 
set. Then there is a system Z( ,K) £ C R such that Bel(Tt oK ), { )) = K and 

Bel(Z(o,K), ()) ol P = Bel(I(o,K), (<£>)) 

for all ip G C e . 

Proof: Let o be an AGM revision operator and let K C C e be a consistent belief set. By 
Lemmas A. 2 and A. 5, there is a system I(o,k) = ('R-(o,k)i 7T (o,k)i'P(o,k)) £ C R such that 
PLx {o K) \= (p—*ip if and only if ip G K o ip. Our construction is such that ip 6 if o ip if and 
only if P^j (o K) |= tp—*ip. Using Lemma A.4, we get that PLj, K) \= ip^-ip if and only if 
Y> G Bel(J (0 ^), (</>}). Thus, K o ip = Bel(J (0)K) , (p)). 

Finally, we show Bel(Z( 0j ^), ()) = K. We start by showing that Kotrue = K. Using R3, 
we get that Kotrue C C7(if U {irtie}) = Since if is consistent, by R4, C7(if U {irtie}) C 
if o irue. Thus, K o irtte = if. By Lemma A.4, we have that Bel(X, ( )) = Bel(2T, {true)). 
Since Bel(T, {true)) = if o £rae, we conclude that Bel(T( Q ( )) = if . □ 

We next prove Theorem 5.3. 

Theorem 5.3: Lei T be a system in C R . Then there is an AGM revision operator o x such 
that 

Bel(l,{))o I i P = Bel(l, {ip)) 

for all ip G C e . 

Proof: Let 1 = (1Z, it, V) be a system in C R . It is easy to verify that PLj satisfies the 
conditions of Lemma A. 3 with if = Bel(X, ()). This lemma implies that there is a revision 
operator oj such that ip G if o% 'P if and only if PLj \= (p — *ip. Using Lemma A.4, we have 
that ip G Bel(T, (99}) if and only if Plj |= <p—*ip. Thus, we have that K oj ip = Bel(X, {ip)) 
for all formulas ip. □ 
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Theorem 5.4: Let X be a system in C R and s a = (o\, . . . , o m ) be a local state in X. Then 
there is an AGM revision operator oj^ Sa such that 

Bel(X, s a ) o x , Sa ip = Bel(I, s a ■ <p) 

for all formulas ip G C e such that o\ A . . . o m A ip is consistent. 

Proof: The structure of the proof is similar to that of Theorem 5.3. As in that proof, 
we construct a ranked plausibility structure and use Lemma A. 3 to find an AGM revision 
operator. The main difference is that after observing ipi, . . . , ip^, some events are considered 
impossible. Lemma A. 3, however, requires that all possible formulas are assigned a positive 
plausibility. We overcome this problem by assigning a "fictional" positive plausibility to all 
non-empty events that are ruled out by the previous observations. 

We proceed as follows. Let do be a new plausibility value that is less plausible than 
all positive plausibilities in Pl a ; that is, if Pl a (A) > _L, then Pl a ( J 4) > do. Let X = 
(TZ,7r,V) G C R ; let s a = (o±, . . . ,o m ). We define PL = (1Z, PI, 7Tpl x ), where PI is such that 
Pl([<£>]) = m&x(P\ a (TZ[(p A A2=i °i])>^o) f° r an consistent formulas ip. This definition implies 
that if ip is consistent with A™ i o*, then Pl([^]p L ) = Pl a (TZ[(fi A A™ i o*]). 

We now prove that if <p is consistent with AE^i °»> then PL \= ip — tip if and only if 
PLi\={<pA/\? =1 Oi)^. 

For the "if" part, assume that PLj \= (ipA/\£ =1 Oj) — tip. Since if is consistent with A^Li °i 
it follows, from REV3, that P\ a {K[ip A (A™ i <h\)) > J_. Thus, Pl a (K[((p A (A™ i Qi)) A ip}) > 
Pl a (TZ[{f A (A™ i Oi)) A -i^]) > _L. Thus, (p A ip is consistent with A™ i o*. This implies 
that Pl(fo> A V]) = PlaCR-lif A (A" i Oi)) A ip] > max(d , Pl a (^[(<^ A (A™i <*)) A -n^D = 
Pl([<p A -iV])- We conclude that PL (= >V- 

For the "only if" part, assume that PLj \/= (ip A (A£Li This implies that 

P\ a (lZ[{p A {AT =1 Oi)) A iP)) ? Pl a (^[(^ A (A^=i Oi)) A ^iP\). Since Pl a is a ranking, it 
follows that P\ a {1l[{ip A (A™ i Oi))iP}) < Pla(K[(tp A (A™ i *)) A -V])- Since _L < Pl a (n[p A 
(A^i Oi)]) = max(Pl a (ft[( V A (A™i Oi)) A ^]),Pl a (^ A (A™i <*)) A ^])), we have that 
Pl a (K[(<p A (A™ i Oi)) A -ip]) > _L. We conclude that Pl([y> A ^ipj) > Pl([p A VI)- Thus, 
PL ^ p-^. 

It is easy to verify that PL is ranked, and satisfies the requirements of Lemma A. 3. Thus, 
there exists a revision operator oj So such that ip G K oj Sa </? if and only if PL \= <p — tip, 
where K = {ip : PL \= true— up}. Moreover, since for all ip consistent with f\iLi °i we have 
thatPL |= ip— tip if and only if PLj \= (ip A (A£Li Oi))—np, then, from Lemma A. 4, it follows 
that K = Bel(X, s a ) and that if ip is consistent with A£Li °ii then PL \= (p—np if and only 
if ip G Bel (J, s a ■<£>).□ 

Theorem 5.5: Let X be a system in C R whose local states are £c e . There is a function 
BSj that maps epistemic states to belief sets such that 

• if s a is a local state of the agent inX, then Bel(X,s a ) = BSj(s a ), and 

• (o,BSx) satisfies Rl'-Rg. 

Proof: As we said earlier, roughly speaking, we define BSx(^a) — Bel(X, s a ) when s a is a 
local state in X. If s a is not in I, then we set BSj(s a ) = Bel (2", s'), where s' is the longest 
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consistent suffix of s a . We now make this definition precise, and show that the resulting 
BSj satisfies Rl'-R8'. 

We proceed as follows. We define a function /(•) that maps sequences of observations 
to suffixes as follows: 



Aside from the special case where o m is inconsistent, we simply choose the longest suffix of 
s a that is still consistent. We define BSj(s a ) = Bel(T, f(s a )). Clearly, if s a is a local state 
in 1, then f(s a ) = s a , so BSj(s a ) = Bel(X, s a ). 

We now have to show that (o,BSj) satisfies Rl'-R8'. The proof outline is as follows. 
Given a particular state s , we construct a ranked plausibility structure that corresponds, 
in the sense of Lemma A. 2, to belief change from s a . We then use Lemma A. 3 to show that 
belief changes from s a satisfies the AGM postulates, i.e., R1-R8. Since this is true from 
any s a , we get that BSj satisfies R1/-R8'. 

Let s a = (oi, . . . ,o m ). We define a ranked plausibility space that has the following 
structure. The most plausible events are the ones consistent with o\ A . . . A o m . They are 
ordered according to the prior ranking conditioned on oi A ... A o m . The next tier of events 
are those that are inconsistent with o\ A . . . A o m but are consistent 02 A . . . A o m . Again, 
these are ordered according to the prior ranking conditioned on 02 A . . . A o m . We continue 
this way; the last tier consists of all events that are inconsistent with o m . 

Formally, let PL = (1Z, PI, ttpl x ), where PI is such that Pl(|[y>]) > P1(M) if Pl a {K[<P A 
(/\i=k oi])) > Pl a (TZ[ip A (/\iL k where k < m + 1 is the greatest integer such that for all 
j < k, p and ip are both inconsistent with AiLj °i- ^ i s eas y to see that PL is ranked, and 
that if if is consistent, then PI ([</?]) > _L. 

Let if G C e . We now show that PL \= tp—*ip if and only if ip G BSj(s a • ip). If ip is 
inconsistent, then PL \= (p — >ip for all ip. Moreover, since cp is inconsistent, f(s a -(p) = (false), 
and thus BSj(s a ■ p) = C e . We conclude that p — >ip if and only if ip G BSj(s a • ip). If p> is 
consistent, then let k < m+1 be the greatest integer such that for all j < k, p is inconsistent 
with A^Lj Oi. It is easy to verify that f(s a -p) = (o^, . . . , o m , p). From Lemma A. 4, it follows 
that V G BSj(s a • ip) = Bel(J, (o k , ...,o m , p)) if and only if Pl a (K[{p A (A7ifc *)) A V]) > 
P\ a (lZ[(p A (Ai^fc A We now show that this is the case if and only if PL \= p — >ip. 

Suppose that PL a (K{(p A A(A™ k <*)) A V]) > PL a (K[(p A (A™ fc <H)) A ^]). Then, clearly, 
Pl a (R,[(<p A (Ai^=fe A tp]) > -L, and thus p A ip is consistent with o k , ■ ■ ■ , o m . Since both 
p Aip and p A -1^ are inconsistent with Oj, . . . , o m for all j < k, we have that Pl([y A ipj) > 



Pl(lp A ->ip})- On other hand, if Pl a (Tl[(p A {/\™ =k 0i )) Aip]) ^ Pl a (K[(ip A (A? =k o t )) A ~<ip]), 
then since Pl a is a ranking PL a {U[(p A (/\T= k Oi)) A V]) < PL a {H[{<p A (A™ k Oi)) A -.^j). 



Moreover, since 95 is consistent with o k A ... A o m , we have that Pl a (7£[</? A (A^Lfe > -L- 
This implies that Pla(ft[(p A (A™ fc Oj)) A > _L and thus Pl({p A ipj) < Pl({p A ^ipj). 
We conclude that PL \= p—>-ip if and only if ip G BSx(s a ■ l f)- 

By Lemma A. 3, there is a revision operator o Sa that satisfies R1-R8 such that ip G Kop 
if and only if PL \= p — tip. It is not hard to check that this implies that the change from 
BSj(s a ) to BSj(s a • p) satisfies Rl'-R8'. □ 




( ) if m = 0, 

(false) if m > and o m is inconsistent, 

(0^, . . . , o m ) otherwise, with k < m the minimal index 
s. t. \/ Ce -(o fc A ... A 

Om ) • 
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Proposition 5.6: Let 2 be a system in C whose local states are £c e . There is a function 
BSj that maps epistemic states to belief sets such that 

• if s a is a local state of the agent inX, then Bel(2,s a ) = BSj(s a ), and 

• (o,BSx) satisfies Rl' -RSt . 

Proof: As we said in the main text, we show that the function BSj defined in the proof of 
Theorem 5.5 satisfies R9'. Let s a = (o±, . . . , o m ), and let (p,ip € C e be formulas such that 
Vc e A ip). Since ip is consistent with ip, we get that f(s a ■ <p ■ ip) = (o^, . . . , o m , ip, ip), 
where k < m is the least integer such that ipAip is consistent with o^, . . . ,o m . For the same 
reason, we get that f(s a -ipAip) = (o&, . . . , o m , ip A ip). Using Lemma A. 4 we immediately 
get that Bel (2", (o^, . . . , o m , ip, ip}) = Bel (2", (o^, . . . , o m , ip A ip)). Thus, we conclude that 
BSj(s a ■ <p ■ ip) = BSj(s a ■ tp Aip). □ 

Theorem 5.7: Given a function BSc e mapping epistemic states in £c e to belief sets over 
C e such that BSc e (( )) is consistent and (BSc e , o) satisfies Rl 1 ' -RSf ' , there is a systemX G C R 
whose local states are in £c e such that BSc e {s a ) = Bel(I, s a ) for each local state s a in 2. 

Proof: We show that Bel(2, s a ) = BS£ e (s a ) for local states s a in 2, where 2 is the system 
guaranteed to exist by Theorem 5.2 such that Bel(2, (}) = BS/; e ((}) and Bel(2, (</?)) = 
BS£ e ((</?)) for all ip G C e . We prove this by induction on the length m of s a . For 
m < 1, this is true by our choice of 2. For the induction case, let s a = {o±, . . . ,o m ) 
be a local state in 2. Thus,, o\ A . . . A o m is consistent. From R9', it follows that 
BS£ e ((oi, . . . ,o m )) = BSc e ((°ii ■ ■ ■ ,°m~2,o m ~-i Ao m )). Using the induction hypothesis, 
we have that BS£ e ((oi, . . . ,o m _ 2 ,o m _i A o m )) = Bel(2, (oi, . . . ,o m _ 2 ,o m _i A o m )). Using 
Lemma A. 4, we get that Bel (2, (o±, . . . , o m _2, o m _i A o m )) = Bel(2, (oi, . . . , o m )). Thus, we 
conclude that BS/; e ((oi, . . . ,o m }) = Bel(2, (oi, . . . ,o m )). □ 

A. 2 Proofs for Section 6 

In this section we prove Theorem 6.2. We now show that any system in C u corresponds to 
an update structure. Suppose that 2 = (1Z, it, V) € C u is such that the set of environment 
states is <S e and the prior of BCS5 is consistent with distance function d. Define an update 
structure Uj = (S e ,ir e ,d), where for p £ <£ e , 7r e (s e )(p) = n((s e , s a ))(p) for some choice of 
s a . By BCS1, the choice of s a does not matter. It is easy to see that UPD1 ensures that 

and 7r e satisfy the requirements of the definition of update structures. We want to show 
that belief change in 2 corresponds to belief change in Uj in the sense of Theorem 6.1. 
Since Theorem 6.1 states that any belief change operation defined by an update structure 
satisfies U1-U8, this will suffice to prove the "if" direction of Theorem 6.2. To prove the 
"only if" direction of Theorem 6.2, we show that that for any update structure U, there is 
a system 2 € C u such that Uj = U. 

We start with preliminary definitions and lemmas for the "if" direction of Theorem 6.2. 
Let s a = (oi,...,o m ). We define States(2,s a ) = {s G S e : s \= £ for all £ G Bel(2, s a )}. 
Clearly, if ip is such that Bel(2, s a ) = Cl(ip), then States (I, s a ) = l<p}u x - To show that 
belief change in 2 corresponds to belief change in Uj we have to show that 

States (J, s a -ip) = min Ux (States (1, s a ), [Vfe)- 
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This is proved in Lemma A. 8. To prove this lemma, we need some preliminary lemmas. 

Lemma A. 6: Let T G C u , and let s a = (o±, . . . , o m ) . Then ip G Bel(l, s a ) if and only if 
(J, r, 0) (= (0°i A ... A O m Om)— >0™ 1 /' f or some run r in 1Z. 

Proof: The proof of this lemma is analogous to the proof of Lemma A. 4, using UPD3 and 
UPD4 instead of REV3 and REV4. We do not repeat the argument here. □ 

We now provide an alternative characterization of States(Z, s a ) in terms of the agent's 
prior on run-prefixes. 

Lemma A. 7: Let I G C u and let s a = (o±, . . . , o m ). Then s m G States (I, s a ) if and only if 
there is a sequence of states [so, . . . , s m ] C 7Z[true, o\, . . . , o m ] such that Pl a ([so, • • • , s m ]) ft 
Pl a (TZ[true,o 1 , . .. ,o m ] - [s , . . .,s m ]). 

Proof: For the "if" direction, assume that there IS db S6CJU6I1C6 Sq, . . . , S m Slicll tllclt 
[s ,...,s m ] C K[true,Oi,...,o m ], and Pl a ([s , ■ ■ ■ , %]) Pl a (TZ[true, o 1 ,...,o m ] - 
[Sq, ■ ■ ■ i S m ]). By way of contradiction, assume that s m g" States (I, m). Thus, there is a for- 
mula £ G Bel(T, m) such that s m \= From Lemma A. 6 it follows that since £ G Bel(T, s a ), 
(I, r, 0) |= (0°i A ... A O m °m) — >O m £ f° r some run r in TZ. From the definition of condition- 
ing it follows that Pl a (1Z[true, oi, . . . , o m _i, o m A £]) > Pl a (7^[irue, oi, . . . , o m _i, o m A ->£]). 
Since s m |= we get that [so,...,s m ] C 7£[trae, Oi, . . . , o m _i, o m A ->£] and that 
7Z[true, o\, . . . , o m _i, o m A £] C TZ\true, o±, . . . , o m ] — [sq, . . . , s m ]. From Al, it follows that 
Pl a ([s ,...,s m ]) < Fla(K[true , Oi, . . . , o m ] — [so, • • • , Sm])j which contradicts our starting 
assumption. We conclude that s m G States (I, s a ). 

For the "only if" direction, assume that s m G States (I, a). Since S e is finite and 7r e 
assigns a different truth assignment to each state in S e , there is a formula £ G C e that 
characterizes s m ; that is, s \= £ if and only if s = s m . Since s m G States (I, s a ), we have that 
^£ Bel(J,a a ). Using Lemma A.6, we get that (J,r,0) ^ (Ooi A ... A O m Om)^0"^£ 
for all runs r E 7Z. By BCS5, this is true if and only if P\ a (JZ[true, o±, . . . , o m \) > _L 
and Pl a (lZ[true, oi, . . . , o m _i, o m A £]) ^ Pl a (7^[irue, Oi, o m _i, o m A -.£]). By UPD2, 
there is a sequence [so, ■ ■ ■ , s m ] C lZ[true, oi, . . . , o m _i, o m A £] such that Pl a ([so, . . . , s m ]) ^ 
Pl a ([sg, . . . , s' m ]) for all [sq, . . . , s' m ] C 7Z[true, o±, . . . , o m _i, o m A ->£]. Moreover, without loss 
of generality, we can assume that Pl a ([so, . . . , s m ]) ^ Pl a ([sg, . . . , s' m ]) for all [s' , . . . , s' m ] C 
7Z[true, o\, . . . , o m -i,o m A £], since there are only finitely many such sequences. Thus, by 
UPD2, Pl a ([s , ...,s m ]) ft Pl a (JZ[true, o 1 ,...,o rn }- [s , s m ]). □ 

We can now prove that belief change in 1 corresponds to belief change in Uj. 
Lemma A.8: Let T = (TZ, ir, V) G C u Then 

States (1, s a ■ ip) = mm UT (States (I, s a ), \^\u x ) 
for all local states s a and formulas ip G C e . 

Proof: Let Pl a be the prior in I; assume that Pl a consistent with a distance function d. 
Let s a = (oi, . . . ,o m ). 
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To show that min^ ( States (2, s a ), {ip}u x ) Q States (X,s a ■ ip), suppose that s G 
mmjj x (States(2 , s a ), fipjui)- Thus, there is a state s m G States(2, s a ) such that d(s m , s f ) ^ 
d(s m ,s) for all states s' that satisfy ip. We want to show that s G States (I, s a ■ 
■ip). From Lemma A. 7, it follows that, since s m G States (2, s a ), there is a sequence 
s , ...,s m -i such that [s ,...,s m ] G K[true, 01, . . . , o m _i, o m ] and Pl a ([s , • • • , s m ]) ft 
Pla(Tl[true,oi,...,o m -i,o m ] - [s , . . . , s m ]). We now show that Pl a ([s , . . . , s m , s]) ■£ 
P\ a (lZ[true,oi, . . . ,o m ,ip] — [so, . . . , s m , s]). By Lemma A. 7, this suffices to show that 
s G States (2, s a ■ ip). Suppose that [s , . . . , s^ +1 ] C 1Z[true, o±, . . . , o m , ^] — [so, • • • , s m , s]. 
If [so, • • • , s m ] = [s' , . . . , s^J, then we have that d(s' m , s' m+1 ) d(s m , s). Since Pl a is con- 
sistent with d, it follows that Pl a ([so, s]) ^ Pl a ([s ' • • • > s m> s ' m +i\)- If [ s o, •■•,%] / 
[s' , . . . , 41) then, since Pl a ([so, • • • , s m ]) ^ Pl a ([s , . . . , s' m ]) and Pl a is consistent with d, 
we have that Pl o ([s , • • • , s m , s]) ^ Pla([s , . . . , s' m , s' m+1 ]). 

Since Pl a ([s , . . . , s m , s]) ^ Pl a ([s' , . . . , s^, s^ +1 ]) 

for all [s , . . . , s' m+1 ] C lZ[true, o\, . . . , o m , ip] — [so, • • • , s m) s] and Pl a is prefix-defined, we 
have that Pl a ([so, • • ■ ,%,«]) ^ Pl a (7^[irue, 01, . . . ,o m , V'] - [«o, • • • ,s m ,s]. By Lemma A. 7, 
s G States (2, s a ■ ip), as desired. 

To show that States(2,s a ■ ip) C min[/ ;r (5 l taies(2r, s a ), Mc/i)) suppose that s G 
States (2, s a ■ ip). By Lemma A. 7, there is a sequence sq, . . . ,s m such that [so, • • • , s m , s]) C 
K[true,0!, . . . ,o m ,ip] and Pl o ([s , ■ ■ ■ , %, «]) 5^ Pl a (^[irae, 01, . . . , o m , ip] - [s , . . . , s m , s]). 
We want to show that s m G States (2, s a ) and that d(s m , s') ^ d(s m , s) for all s' that satisfy 
ip. This suffices to prove that s G mm^ (States (2, s a ), {ip}u x )- 

To show that s m G States (2, s a ), by Lemma A. 7, it suffices to show that Pl a ([so, . . . , s m ]) 
Pl a (lZ[true, 01, . . . , o m ] — [sq, . . . , s m ]). Let s , . . . , s^ be a sequence such that [s , . . . , s' m ] C 
1Z[true, 01, . . . , o m ]. By definition, [s , . . . , s^, s] C 7^[ir?xe, 01, . . . , o m , ip]. Thus, from our 
choice of so, ... , s m , it follows that Pl a ([so, • • • , s m , s]) ^ Pl a ([s , . . . , s' m , s]). Since Pl a is 
consistent with d, it follows that Pl a ([so, ■ ■ ■ , s m ]) -ft Pl a ([s , . . . , s' m ]). Thus, by Lemma A. 7, 
s m G States(2, s a ). To see that d(s m , s') d(s m , s) for all s' that satisfy ip, let s' 7^ s be such 
that s' |= ip. Thus, [so, . . . , s rn , s'] C [true, 0\, . . . , o m , ip]. From our choice of so, . . . , s m , 
it follows that Pl a ([so, ... ,s m ,s]) -ft Pl a ([so, . . . , s m , s']). Since Pl a is consistent with d, it 
follows that d(s m ,s') ft d(s m ,s). We conclude that s G min^ (States (2, s a ), {ip}u x )- Q 

We now have the tools to prove the "if" direction of Theorem 6.2. 

Lemma A.9: If 2= (K,n,V) G C u , then there is a belief change operator o that satisfies 
U1-U8 such that 

Bel(2, s a )oiP = Bel(2, s a ■ 1P) 
for all local states s a and formulas ip G C e . 

Proof: Let 2 G C u . Using the arguments we presented above, it easy to check that Uj 
is an update structure. By Theorem 6.1, there is a belief change operator o that satisfies 
U1-U8 such that [1^0^]^ = min^d^]^ , [V'lt/i) for all 99, ip G C e . From Lemma A. 8, it 
follows that Bel(X, s a ) oip = Bel(T, s a ■ ip). □ 

We now prove the "only if" direction of Theorem 6.2. Suppose that o is a belief change 
operator that satisfies U1-U8. According to Theorem 6.1, there is an update structure [/<> 
that corresponds to o. Thus, it suffices to show that there is a system 2 such that Uj = U . 
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Lemma A. 10: Let U = (W,d, ttjj) be an update structure. Then there is a system X G C u 
such that Uj = U. 

Proof: Given the sequences Wq, W\, . . . £ W and 01,02,... G £ e , let r w o,wi,...;oi,o 2l ... ^ e ^ e 
run denned so that r «>o>«>i,-;°i>°2,-( m ) = Wjn an d r ™o,«>i,-;°i,°2,...( m ) = (o 1 ,...,o m ). Let 
_ | r w) ,wi,...;oi,o 2 ,... . -Ku(w m )(o m ) = true for all m}. Define -it such that 7r(r, m)(p) = 
irjj(r e (m))(p) for p G <3> e and ir(r,m)(learn((p)) = true if 0( r?n ) = for 99 € £ e . 

It is clear that (TZ,tt) satisfies BCS1-BCS4 and UPD1. Thus, all that remains to show 
is that there is a prior plausibility measure Pl a that satisfies UPD2-UPD4. This will ensure 
that {K,ir,V) G C u . 

We proceed as follows. We define a preferential space (TZ, -<) where r -< r' if and only 
if there is some m such that r e (k) = r' e {k) for all < k < m, r e (m + 1) 7^ r' e {m + 1), and 
d(r e (m), r e (m + \)) < d(r' e (m),r' e (m + l)). Recall that r -< r' denotes that r is preferred over 
r'. Thus, this ordering is consistent with the comparison of events of the form [so, ■ ■ ■ ,s n ] 
according to UPD2. 

Using the construction of Proposition 2.2, there is a plausibility space (i?, Pl a ) such that 
Pla {A) > Pla(-B) if and only if for all r G B — A, there is a run r' G A such that r' <r and 
there is no r" G B — A such that r" -< r'. By (Friedman & Halpern, 1998b, Theorem 5.5), 
Pl a is a qualitative plausibility measure. We now show that it satisfies UPD2-UPD4. 

We start with UPD2. To show that PLa is consistent with d, we need to show that 
Pl a ([so, ... ,s n ]) < Pl a ([sQ, ... ,s' n ]) if and only if there is some m < n such that su = s' k 
for all < k < m, and d(s m ,s m+ i) > d(s' m , s' m+1 ). Suppose that Pl a ([so, • • • , s n ]) < 
Pl a ([sg, . . . ,s' n ]). Let r be some run in [sq, ■ ■ ■ ,' n ]• Without loss of generality we can assume 
that r e (m) = r e (n) for all m > n. Since Pl a ([so, ■ ■ ■ ,s n ]) < PlaG^o, • • • , s' n ]), there is a run 
r' G [s' , ... ,s' n ] such that r' -< r. By definition, this implies that there is an m such that 
r e (k) = r' e (k) for all < k < m, and d(r' e (m), r' e (m + 1)) < d(r e (m),r e (m + 1)). We claim 
that m < n. For if m > n, then r e (m+l) = r e (m) by construction, so d(r e (m), r e (m+ 1)) = 
d(r e (m),r e (m)) < d(r' e (m) , r' e (m + 1)) and r' 7^ r, a contradiction. Thus, = for all 
< k < m, d(s' m , s' m+1 ) < d(s 

For the converse, suppose that there is an m < n such that s^ = s' k for all < k < m, 
and d(s' m , s' m+1 ) < d(s m , s m +i). Let r' be the run where r' e (k) = s' k for k < n, r' e (k) = s' n 
for k > n, and Oi r i^\ = true for all k. It follows r' < r for all runs r' G [so, . . . , s n ]. Thus, 
Pl a ([s ,...,s n }) <Pl a {[s' ,...,s' n ]). 

To show that Pl a is prefix-defined, we must show that Pl a (lZ[(po, • • • , <p n ]) > Pl a (^[V ; o ) ■ ■ ■ , VVi]) 
if and only if for all [so, . . . , s n ] C 7^[^o 5 ■ ■ ■ , ^n] — T^^fo, ■ ■ ■ , ^n], there is some [s' , . . . ,s' n ] C 
^[930, • • • , Vn] such that Pl a ([s , • • -,s' n ]) > Pl a ([so, • • •,««])■ Suppose that Pl a (7^[<^ , • • -,<Pn]) > 
Pl a (^[^ , • • • ,ipn])- Let [s , • • • ,s n ] C 7e[^o,. • • ,ip n ] -K[yo,.. .,¥>„]. Let r G [s , . . . , s n ] be 
a run such that r e (m) = r e (n) for all m > n. Since Pl a (72-[yo ) ■ • ■ , <Pn]) > Pla(^-[V'o ; • • • > V'n]) 
there is a run r' G 1Z[npo, . . . , </? n ] such that r' -< r. This implies that there is an m such 
that r e (k) = r' e (k) for all < k < m, and d(r' e (m) , r' e (m + 1)) < d(r e (m),r e (m + 1)). 
As before, we have that m < n, and thus Pl a ([rg(0), . . . , r' e (n)]) > Pl a ([so, . . . , s n ]). Since 
r' G TZ[(po, . . . , (/?„], we also have that [r' e (0), . . . , r' e (n)] C 72.[</?0) • • • > Vn], as desired. 

For the converse, assume that for all [so, . . . ,s n ] C ^.[V'O; • • • j V'n] — ^-[voi ■ ■ ■ j Vn] there 
is some [s , . . . , s' n ] C ^[^0, ■■■,¥>«] such that Pl o ([s , . . . , s' n ]) > Pl a ([so, • • • , s n ]). This im- 
plies that Pl a (7£[(/? , • • • , <p n \) > Pla ([so, ■ ■ ■ , s n ]) for all for all [s , . . . , s n ] C 7£[V>o, • • • , ipn] ~ 



162 



Modeling Belief in Dynamic Systems. Part II. 



H[tpo, . . . , ip n ]. Since there are only finitely many sequences of states of length m, we can ap- 
ply A2, and conclude that Pl a (lZ[ipo, ■■■ , <p n ]) > Pl a (^.[V'o, ■■■,ipn]- fc[<Po, ■■■ , <Pn])- Thus, 

Pl a (^[99 , • • • , <p n ]) > Pla((^[^0, • • • , Y>n]))- 

For UPD3, recall that the construction of Proposition 2.2 is such that Pl a (-R) > -L for 
all non-empty R C 1Z. Since, by our construction, the set lZ[ipo, . . . , ip n ] is non-empty for 
all sequences (fo , . . . , (p n of consistent formulas, UPD3 must hold. 

Finally, we consider UPD4. We have to show that Pl a (TZ[(fo, • • • , fn+i', 01, . . . , o n ]) > 
Pl a (K[ipo, ■ ■ ■ ,ip n +i;oi,. . . ,o n ]) if and only if Pl a (7£[<£> , ¥>iAoi, . . . ,<p n Ao n ,ip n+1 ]) > Pl a (7e[^ , V'l A 
ox,..., ip n Ao n , VVi+i])- By construction, K[(p , f n +i; o\, o n ] C 1Z[(p , tfiAoi, ip„A 
o n , <Pn+i\- On the other hand, for each run r £ lZ[(po, tp\ A 01, . . . , (p n A o n , <p n +i] there is 
a run r' G H[(fo, ■ ■ ■ , <p n +i) °i, ■ ■ ■ > °n] such that r' e (m) = r e (m) for all m, and 0( r , m ) = °m 
for 1 < m < n. Since the preference ordering on runs is a function only of the environ- 
ment states, it is clear that r and r' are compared in the same manner; that is for all 
r" , r" -< r if and only if r" -< r', and r -< r" if and only if r' -< r". Thus, we conclude 
that for the purposes of the preference ordering, both TZ[(po, ip\ A o\, . . . , ip n A o n , (p n +i] an d 
TZ[ifo, ■ ■ ■ , tpn+i', oi, ■ ■ ■ ,o n ] are compared in the same manner to other sets. It easy to see 
that this suffices to show that Pl a satisfies UPD4. □ 

Finally, we can prove Theorem 6.2. 

Theorem 6.2: A belief change operator o satisfies U1-U8 if and only if there is a system 
2 G C u such that 

Bel(l, s a )oi> = Bel(l, s a ■ ip) 
for all epistemic states s a and formulas if) G C e . 

Proof: The "if" direction follows from Lemma A. 9. For the "only if" direction, assume that 
o satisfies U1-U8. By Theorem 6.1, there is an update structure U such that [99 oipji/j = 
min^d^]^ , [^It/i) f° r a h V 5 ) V' £ £e- By Lemma A. 10, there is a system I G C u such that 
Uj = U . From Lemma A. 8, it follows that Bel(X, s a ) oip = Bel(X, s a • ip) for all local states 
s a and formulas tp G C e . □ 
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